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The President’s National Security Telecommunications Advisory Committee 


Executive Summary 


Purpose 

This edition of the President’s National Security 
Telecommunications Advisory Committee Issue Review 
provides a comprehensive report of issues 
addressed by the President’s National Security 
Telecommunications Advisory Committee (NSTAC) 
from its first meeting in December 1982 to its 
most recent meeting on May 10, 2006. For each 
active, standing, and previous issue addressed by 
the NSTAC, the NSTAC Issue Review provides the 
following information when applicable: names of the 
investigating groups, length of time required for the 
investigation, issue background, a synopsis of NSTAC 
actions and recommendations, actions resulting 
from NSTAC recommendations, reports issued, and 
members of the current/active investigating groups. 

Background 

On September 13, 1982, President Ronald Reagan 
issued Executive Order (E.O.) 12382, establishing 
the President's NSTAC. The NSTAC, a presidentially- 
appointed advisory body composed of up to 30 
senior executive level representatives from the 
communications, hardware, software and security 
services, banking, and aerospace companies 
provides the President with a unique source of 
national security and emergency preparedness 
(NS/EP) communications policy expertise. Several 
factors influenced the establishment of the NSTAC 
at that time, including the divestiture of AT&T, 
increased Government reliance on commercial 
communications, and the potential impact of 
new technologies on communications supporting 
NS/EP requirements. Appendix A of this document 
includes E.O. 12382, as well as additional NSTAC 
implementing and governing documentation. 
Appendix B provides a listing of current NSTAC 
members as of May 10, 2006. 

Since its inception, the NSTAC has advised seven 
administrations on issues pertaining to the reliability 
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and security of communications technologies and 
their impact on the Nation’s ability to protect its 
critical infrastructures—issues vital to America’s 
security and economic interests. Today, members 
of the communications and information technology 
industries, as well as the Federal Government, 
recognize the NSTAC as a model for industry/ 
Government collaboration. NSTAC accomplishments 
include many substantive recommendations to the 
President leading to enhancements of the Nation’s 
NS/EP communications capabilities and critical 
infrastructure policies, and increased safeguards to 
the Nation’s communications infrastructure. 

Over the past 24 years, the NSTAC has worked 
cooperatively with the National Communications 
System (NCS), an interagency consortium of Eederal 
departments and agencies that serves as the focal 
point for NS/EP communications planning for any 
crisis or disaster and provides staff support and 
technical assistance to the Committee. By virtue of its 
mandate to address NS/EP communications issues, 
the NSTAC’s partnership with the NCS is unique in 
two ways: (1) it facilitates industry involvement with 
both the defense and civil agencies comprising the 
NCS; and (2) it regularly sustains interaction between 
industry and the NCS member departments and 
agencies through the National Coordinating Center 
(NCC); the Communications Information Sharing and 
Analysis Center; the Network Security Information 
Exchange (NSIE) process; and most recently through 
the Communications Sector Coordinating Council, 
which serves as a point of contact for its counterpart 
the Government Coordinating Council. The NSTAC’s 
perspective and its experiences with a wide range 
of Eederal departments and agencies make the 
committee a key strategic resource for the President 
and his national security and homeland security 
teams in their efforts to protect our Nation’s critical 
infrastructures in today’s dynamic and evolving 
environment. 


iii 


EXECUTIVE SUMMARY ◄ NSTAC XXIX Issue Review 


Membership on the NSTAC's primary working 
body—the Industry Executive Subcommittee (lES)— 
consists of one representative from each company, 
appointed by his or her NSTAC Principal. The lES 
holds regular meetings to consider issues, analyses, 
and/or recommendations for presentation to the 
NSTAC Principals (and in turn to the President), and 
assists in the formation of fask forces and working 
groups as directed by the Committee to address 
specific issues requiring in-depth analyses. 

During the NSTAC XXIX cycle, from May 2005 
to May 2006, the NSTAC operated the following 
subordinate task forces and working group: 

► The Emergency Communications and Interoperabiiity 
Task Force initiated an examination of how 
communications technologies should be 
integrated into the Federal Government’s 
emergency communications planning to support 
NS/EP activities and to recommend a future 
direction to ensure a survivable and interoperable 
communications architecture for responders. 

► The National Coordinating Center Task Force 

examined the direction and structure of the 
NCC and how it should continue to partner 
with Government. In addition, the group also 
developed a roadmap of action items for use by 
the NCC to assist it in evolving to address new 
issues over the next five years. 

► The Next Generation Networks (NGN) Task Force 

examined how the Government can ensure NS/EP 
telecommunications requirements continue 
to be addressed on the NGN. In addition, the 
group proposed substantive recommendations 
to the President regarding facilitating NS/EP 
communications over converging networks. 

► The Teiecommunications and Eiectric Power 
Interdependency Task Force examined the NS/EP 
issues associated with the interdependency of the 
telecommunications and electric power sectors 
and how these interdependencies will affect the 
future of the telecommunications network. 
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► Ceiiuiar Service Shutdown Ad Hoc Working Group 

examined a process for determining if and when 
cellular services should be terminated in the event 
of a national emergency. 

► The Legislative and Regulatory Task Force continued 
to review and analyze legislative and regulatory 
activities affecting the NS/EP community. In 
addition, the group developed recommendations 
to the President on the need for adequate Federal 
assistance to telecommunications infrastructure 
providers during disasters such as hurricanes. 

► The Research and Development (R&D) Task Force 

began planning for the first-ever international 
R&D Exchange Workshop in Ottawa, Ontario, 
Canada in September of 2006. The Workshop 
will focus on multilateral collaborative R&D to 
enhance security on the network. 

Many NSTAC recommendations result in operational 
activities that enhance NS/EP communications 
and information systems. For example, in its 
first set of recommendations to the President, 
the NSTAC suggested the establishment of the 
NCC, an industry and Government coordination 
center for day-to-day operational support to NS/EP 
communications. In addition, the NSTAC assisted 
the Office of the Manager, National Communications 
System in developing and eventually implementing 
the Telecommunications Service Priority (TSP) 

System—one of the NCS’ most utilized priority 
service programs. Furthermore, an NSTAC 
recommendation also resulted in the establishment 
of separate NSTAC and Government NSIEs, which 
meet regularly to address the threat of electronic 
intrusions and software vulnerabilities, as well as to 
discuss mitigation strategies to protect the Nation’s 
critical communications and information systems. 
Finally, the NSTAC recommended the development 
of an access and credentialing program to assist 
private sector companies in gaining access to 
federal disaster sites following an event of national 
significant. In response to this recommendation, 
the Department of Homeland Security developed, 
in partnership with Federal, State, and local 
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Government entities, as weil as a private sector 
company, an access standard operating procedure 
(SOP) to ensure that private criticai infrastructure 
responders receive priority access to disaster areas. 
The State of Georgia adopted the access SOP which 
is also being used as an example for other States. 

Appendix C of this document contains the NSTAC 
XXIX Executive Report to the President, which 
includes summaries of the May 2006 NSTAC XXIX 
Business and Executive Sessions, Executive Breakfast 
and Executive Luncheon, as well as task force 
recommendations made to the President during the 
NSTAC XXIX Cycle (May 2005-May 2006). 

Copies of NSTAC reports pertaining to the issues 
addressed in this document are available through: 

Office of the Manager 

National Communications System 

Customer Service Division 

Mail Stop #8510 

245 Murray Lane, Building 410 

Washington, DC 20528 

(703) 235-5525 

www.ncs.gov/nstac/nstac.html 

nstacl@dhs.gov 
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Next Generation Networks 

Investigation Group / Period of Activity 

Network Group 

April 1997 - September 1999 

Convergence Task Force 

June 2000-June 2001 

Network Security Vulnerability Assessments Task Force 

June 2001 - March 2002 

Next Generation Networks Task Force 

May 2004 - May 2006 

Issue Background 

For several years, global communications networks 
have functioned in a period of transition as customer 
demands and business imperatives cataiyzed the 
convergence of traditionai circuit switched networks 
with broadband packet-based Internet Protocol 
(IP) networks to create the telecommunications 
industry’s next generation network (NGN). 

Although the complete evolution to the NGN is 
expected to take many years, this evolving network 
infrastructure, which includes wireless, wireline, 
and IP technologies, will alter the way governments 
and private industry meet their national security and 
emergency preparedness (NS/EP) communications 
needs. In fact, the emergence of the NGN has 
already effected change in a profound way. Many 
network service providers have already developed 
the capability to carry voice, video, text, and data 
transparently to numerous categories of end-user 
devices, a key characteristic of the NGN. Mobile 
phones able to access an array of Web-based 
services represent only one example of this 
enhanced ability. 

The scale, scope, and character of the NGN will 
fundamentally change the way governments and 
service providers plan for, prioritize, and ultimately 
deliver NS/EP communications. NGN networks. 
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which are largely packet-switched networks, differ 
greatly from legacy circuit-switched networks. Eor 
example, packet-switched environments place 
control capabilities at the network “edge” and 
rely heavily on intelligent devices to execute key 
functions. In this new environment, NS/EP and 
critical business communications will be subject 
to an increased number of cyber threats based 
on inherent vulnerabilities and interdependencies 
known or expected to exist in the NGN. With 
these changes, network operators, infrastructure 
custodians, and NS/EP users must determine how 
best to meet NS/EP user requirements on the NGN. 

The transition to the NGN also presents challenges 
for ensuring the security and availability of NS/EP 
communications. In addition to the vulnerabilities 
that arise due to the packet-switched nature of the 
NGN, some vulnerabilities that already existed in 
legacy networks will persist or worsen in the NGN. 
For example, the enhanced interconnectedness of 
the NGN can be exploited by hackers to provide 
rapid and far-reaching propagation of malicious 
payload (attacks). Another vulnerability is the 
emulation of network control messages. Unlike 
legacy networks, which used separate paths to 
divide network control messages from normal 
network payload, NGN architectures have network 
control messages co-existing with normal payload 
traffic, providing more open access to hackers to 
interfere with these messages. These and other 
vulnerabilities create complex risk scenarios for 
NS/EP communications in an NGN environment, 
which also depends on other infrastructures such 
as the electric power industry. A further challenge 
is the global nature of the NGN and, thus, methods 
for managing incidents of national significance may 
require international cooperation. To ensure NS/EP 
functions remain a priority in the transition to the 
NGN, these concerns must be addressed. 

At the same time, the NGN will offer significant 
improvements for the delivery of NS/EP 
communications capabilities as bandwidth and 
software continue to improve. New communications 
capabilities, including greater access to data and 
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new services, will better support NS/EP functions in 
critical ways, enabling first responders, for example, 
to obtain real-time access to voice, data, and video 
necessary for the most effective completion of their 
jobs. The NGN will also naturally increase network 
robustness and resiliency by the nature of its mesh 
architecture, offering many possible paths for 
service and redundancy of equipment and servers. 

To achieve the benefits of such new capabilities 
and greater resiliency, and to speed and enhance 
the transition to NGN, solutions must be found that 
address NS/EP functional requirements, especially 
for security and availability. Doing so requires 
forward-looking action by industry and Government. 

History of NSTAC Actions and Recommendations 

The President’s National Security 
Telecommunications Advisory Committee 
(NSTAC) has an extensive history of examining 
the NS/EP implications of the transition of the 
Nation's telecommunications networks to the NGN 
environment and providing the President with 
forward looking and innovative recommendations. 

I n its Internet Report: Examination of the National Security and 
Emergency Preparedness Implications of Internet Technologies 
Report, published in June 1999, the NSTAC examined 
three key transition factors—the extent to which 
NS/EP operations depend on the Internet, the 
network control element vulnerabilities associated 
with the Internet and their ability to cause a severe 
disruption of Internet service, and how Internet 
reliability, availability, and service priority issues 
applied to NS/EP operations. In Its June 2001 
Convergence TaskEorce Report, the NSTAC furthered Its 
network transition-related work to specifically analyze 
the potential security and reliability vulnerabilities 
associated with converged networks. Its Network 
Security Vulnerability Assessments Task Eorce Report, released 
in March 2002, addressed public network policy 
and technical issues related to network disruptions, 
the security and vulnerability of the converged 
network control space, and needed countermeasures 
to mitigate against these vulnerabilities. Issues 
presented by convergence also arose during 
the Committee’s examination of the resiliency of 


networks supporting the financial services sector to 
physical disruptions. 

Building on this prior work, the NSTAC Principals 
agreed at the NSTAC XXVII Meeting to engage 
subject matter experts (SME) in an examination of 
NS/EP requirements and emerging threats on the 
NGN. Accordingly, the Principals established the 
Next Generations Network Task Eorce (NGNTE) and 
tasked it with developing: 

► A high-level description of the NGN’s expected 
network environment or ecosystem, and its 
interdependencies, on which NS/EP applications 
will rely; 

► NS/EP user requirements for the NGN Including 
how to meet these user requirements both in a 
mature NGN and in the transition phase, how 
to provision end-to-end services, and how the 
interfaces and accountability among network 
participants and network layers will work; 

► Relevant user scenarios and expected cyber 
threats, including recommendations on optimal 
strategies to meet NS/EP user requirements; and 

► International concerns, Including both NS/EP 
functions that must be provisioned internationally 
and international threats to the NGN. 

As an initial step, the NGNTE assembled a group of 
SMEs and government stakeholders in August 2004 
to determine how best to meet the task’s significant 
objectives. As a result of the meeting, the group 
Identified five fundamental areas of examination: 

(1) NGN description; (2) NGN service scenarios 
and user requirements; (3) end-to-end services 
provisioning; (4) NGN threats and vulnerabilities; and 
(5) incident management on the NGN. In response 
to government stakeholder questions during the 
meeting, the NGNTE agreed to undertake a quick turn 
around report on the near term actions that could be 
undertaken to reduce the Impact of network transition 
issues on NS/EP communications and to identify areas 
where immediate government involvement was needed 
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to foster activities in areas such as NGN standards and 
systems development activities that may be proceeding 
without consideration of NS/EP needs. 

Based on the near-term analysis conducted by 
the NGNTF, the Committee offered fhe following 
recommendafions fo the President in March 2005: 

► Use existing and appropriate cross-Government 
coordination mechanisms to track and coordinate 
cross-agency NGN activities and investment; 

► Explore the use of Government [civilian and 
Department of Defense (DOD)] nefworks as 
alternatives for critical NS/EP communications 
during times of national crisis; 

► Use and test existing and leading-edge 
technologies and commercial capabilities to 
support NS/EP user requirements for securify 
and availability; 

► Support the development and use of identity 
management mechanisms, including strong 
authentication; 

► Study and support industry efforts in areas that 
present the greatest NS/EP risks during the period of 
convergence, including gateways, control systems, 
and first responder communications systems; 

► Review the value of satellife systems as a 

broad alternative transmission channel for NS/EP 
communications; 

► Participate more broadly and actively in the 
NGN standards process in partnership with the 
private sector in the following areas: web services, 
directory services, data security, network security/ 
management, and control systems; and 

► Focus on developing cohesive domestic and 
international NS/EP communications policy and 
conduct inter-governmental discussions on NS/EP 
communications. 
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The NGNTF then turned its attention to the longer- 
term taskings, leveraging significant involvement 
from industry and government SMEs involved in the 
day-to-day transition of the NGN and creating working 
groups to address each issue area. Ultimately, the 
NSTAC, based upon the work of the NGNTF, agreed 
upon nine recommendations, the Implementation of 
which they believed would support the ability of the 
NGN to meet NS/EP functional requirements while 
also providing greater capabilities to NS/EP users. 

The NSTAC Principals approved the following 
recommendations to the President in March 2006: 

► Identity Management. Direct the Office of 
Managemenf and Budgef (0MB), the Department 
of Commerce (DOC), and the Department of 
Homeland Securify (DHS) to work with the 
private sector in partnership to build a federated, 
interoperable, survivable, and effective identity 
management framework for fhe NGN thaf: 

(1) includes a common assurance faxonomy thaf 
addresses NS/EP requirements and is usable in 
both the Government and commercial domains; 

(2) minimizes identity “silos” (identity stores 
containing usernames and passwords that is 
not or cannot be used by another applications), 
allows federation between the Government 
and commercial domains, and supports use of 
Government issued credentials for identificafion 
on fhe NGN; (3) meets other NS/EP requirements, 
including priority access to NS/EP communications 
services; (4) supports broad use of commercial 
fechnology, along wifh existing and emerging 
protocols and standards; and (5) includes explicit 
protections for privacy. 

► Coordination on Common Operationai Criteria for 
NGN NS/EP End-to-End Services. Direct the Office 
of Science and Technology (OSTP), with support 
from the collective National Communications 
System (NCS) agencies, to establish a Common 
Operational Criteria development framework to 
meet NS/EP user requirements on the NGN. This 
would be a joint Industry-Government initiative 

to ensure NS/EP communications capabilities in 
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the NGN environment, and would include the 
creation of a regular NGN summit with annual 
reporting that would enable telecommunication/ 
information technology (IT) industry sector and 
Government stakeholders to: (1) develop and 
coordinate common NGN planning activities; 

(2) measure progress of NGN-related efforts; 
and (3) recommend and monitor programs that 
would foster NS/EP capabilities within the NGN, 
including initiatives concerning: 

• A priority regime for both encrypted and 
unencrypted packets supported by a set of 
standards specifying how that priority is to 
be translated end-to-end among the different 
networks connected to the NGN, consistent 
with a user’s NS/EP authorization and required 
class of service; and 

• NGN designs that respond to NS/EP 
requirements, including supporting a mixed 
protocol operational environment during 
the transition into IP version 6; peer-to-peer 
networks and systems for independence from 
centralized infrastructure; meshed networks 
for resiliency and deployability; and IP Security 
for authentication and confidentiality. 

► Research and Development (R&D). In support of 

the prior recommendation, direct OSTP, with support 
from other relevant agencies, especially the Science 
and Technology Directorate of DHS, the National 
Institute of Standards and Technology (NIST), and 
DOD to establish and prioritize within the Eederal 
Government initiatives that will foster collaborative 
and coordinated R&D supporting the Common 
Operational Criteria and accelerate demonstrations 
of critical NGN NS/EP-supporting capabilities or 
technology among NGN telecommunication/IT 
and service providers. 

► Technology Lifecycle Assurance and Trusted 
Technology. Direct 0MB, OSTP, DOD, DEIS, 
and DOC to drive comprehensive change 
in the security of NS/EP information and 
communications technology through policy. 


incentives, and research supporting the 
development and use of: (1) technology lifecycle 
assurance mechanisms; and (2) innovative 
trusted technologies that reduce the presence of 
intrinsic vulnerabilities. 

► Resilient Alternate Communications. Direct 0MB 
and DHS, in accordance with their respective 
authorities, to ensure that Federal agencies 
are developing, investing in, and maintaining 
resilient, alternate communications for the NGN 
environment. Specifically, DHS and 0MB should 
require that NS/EP communicators, including 
incident managers and emergency responders, 
plan for communications resiliency especially 
by examining alternative or substitute access 
methods to the NGN to address specific threat 
scenarios, which methods can augment and 
possibly replace, at least temporarily, damaged 
or diminished access to the communications 
infrastructure. 

► Agreements, Standards, Policy, and Regulations. Direct 
DHS, the Department of State, and DOC (including 
NIST and the National Telecommunications and 
Information Administration) to engage actively with 
and coordinate among appropriate domestic and 
international entities to ensure that the relevant 
policy frameworks support NGN NS/EP capabilities. 
These policy frameworks are established through 
Agreements, Standards, Policies, and Regulations 
(ASPR). As part of the Common Operational Criteria 
development framework, these agencies should 
continuously monitor the entire lifecycle of ASPR 
associated with ensuring NS/EP capabilities to 
identify and act on opportunities to enhance ASPR, 
address their vulnerabilities, and eliminate potential 
impediments to providing NS/EP capabilities in a 
globally-distributed NGN environment. 

► Incident Management on the NGN. Direct DHS 
to establish an inclusive and effective NGN 
incident response capability that includes a 
Joint Coordination Center, incorporating and 
modeled on the National Coordinating Center 
(NCC), for all key sectors, but particularly both the 
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Communications and IT Sectors, and supporting 
mechanisms such as a training academy and a 
collaboratively developed, broadly participatory, 
and regularly evaluated exercise program. This 
capability should be enhanced by an appropriate 
R&D program. 

► International Policy. Direct departments and 
agencies to develop cohesive domestic 
and international NS/EP communications 
policy consistent with the recommendations 
in this report, in particular: (1) developing 
intergovernmental cooperative mechanisms to 
harmonize NS/EP policy regimes in participating 
countries consistent with the recommendations 
in this report; (2) establishing the rules of 
engagement for non-Unifed Stafes (U.S.) 
companies in NS/EP incident response in the 
U.S.; and (3) addressing how information sharing 
and response mechanisms should operate in the 
international NGN environment. 

► First Responders. Direct DHS and other appropriate 
Government agencies to assist first responders 
and public safety organizations in making the 
transition to the NGN, which will provide them 
with greater capabilities, but will also be a 
challenge to achieve given their limited resources 
and legacy systems. 

Eor further detail on the efforts of fhe NSTAC 
relafed fo NGN networks please see the Network 
Convergence section In the Previously Addressed 
section of fhis NSTAC Issue Review. 


Reports Issued 

Network Group Internet Report: An Examination of the NS/EP 
Implications of Internet Technologies, June 1999. 

Convergence Task Eorce Report, June 2001. 

Network Security Vulnerability Assessments Task Eorce Report, 
March 2002. 
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Next Generation Networks Task Eorce Report: Near Term 
Recommendations, March 2005. 

Next Generation Networks Task Eorce Report, March 2006. 
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Mr. Sean Anderson 

Rutgers University 

Dr. Michael Tortorella 

Spectrasite 

Mr. Ted Abrams 

Sprint Nextel Corporation 

Mr. Chase Cotton 
Ms. Allison Growney 
Mr. Keecheon Kim 

Telcordia Technologies, Inc. 

Mr. Arun Handa 
Mr. Robert Lesnewich 

Telecommunication Industry Association 

Mr. David Thompson 

United Telecommunications Council 

Ms. Prudence Parks 

University of California at Berkeley 

Dr. Shannon Lake 

VeriSign, Inc. 

Mr. Anthony Rutkowski 

Verizon Communications, Inc. 

Mr. Timothy Beaird 
Mr. Bruce Fleming 
Mr. Stuart Jacobs 
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Next Generation Networks 

Task Force Government Participants 

Department of Defense 

Mr. Scott Swartz 

Department of Homeland Security 

Mr. Daniel Ahr 
Mr. Gary Amato 
Mr. Steve Carty 
Mr. David Delaney 
Mr. Thomas Falvey 
Mr. Alan Gallagher 
Ms. Mai Tai Galloway 
Mr. John Graves 
Mr. Rick Lichtenfels 
Mr. Thad Odderstol 
Ms. DeJuan Price 
Ms. Carol-Lyn Taylor 
Capt. Eric Koenig 
Mr. Dan Zink 

Federal Reserve Board 

Mr. Chuck Madine 

General Services Administration 

Mr. Doug Covert 
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National Coordinating Center 

Investigation Group / Period of Activity 

National Coordinating Mechanism Task Force 

December 14,1982 - November 15,1984 

Telecommunications System Survivability Task Force 

March 6,1986-June 8,1989 

National Coordinating Center for Telecommunications 
Vision Task Force 

October 15,1996-April 22,1997 

Operations Support Group 

April 22,1997-September 23,1999 

Information Sharing/Critical Infrastructure Protection 
Task Force 

September 23,1999 - May 16,2000 

National Coordinating Center Task Force 

December 14, 2004 - Present 

Issue Background 

Following the divestiture ot the AT&T monopoly in 
1982, the telecommunications industry and the 
Federal Government collectively developed the concept 
of a national coordinating mechanism (NCM) by 
which the public and private sectors could coordinate 
NS/EP telecommunications efforts. A year later, the 
NSTAC recommended the creation of the NCC as the 
operational arm for the NCM. Consequently, in 1984, 
President Ronald Reagan established the NCC within 
the NCS via Executive Order 12382. 

Since that time, threats to the NS/EP 
telecommunications infrastructure have changed 
significantly, heightening the importance of daily 
coordination between industry and Government. 

In May 1998, the President released Presidential 
Decision Directive (PDD) 63, Protecting America's Critical 
Infrastructures, a critical infrastructure protection (CIP) 
directive calling for, among other things, industry 
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participation in the Government’s efforts to ensure the 
security of the Nation’s infrastructures. After studying 
the directive, the NSTAC recommended the NCC 
be designated the Telecommunications Information 
Sharing and Analysis Center (ISAC) as the NCC 
had already been performing similar functions in 
preparation for the Year 2000 rollover efforts. 

The NCC played a key role in maintaining and 
reestablishing NS/EP communications during and 
after the terrorist attacks of September 11, 2001. 

In March 2003, the NCC became part of the DFIS 
as a result of the transfer of the NCS from the 
DOD. Flomeland Security Presidential Directive 
(FiSPD) 7, Critical Infrastructure Identification, Prioritization, 
and Protection, issued in December 2003, succeeded 
PDD-63 and established a new national policy 
for Eederal departments and agencies to identify 
and prioritize U.S. critical infrastructure and key 
resources and to protect them from terrorist attacks. 
As DHS continues to grow and evolve, the NCC 
must also periodically reconsider its structure, 
organization, and approach to keep pace with rapid 
legal and regulatory changes. 

In 2006, the NCC finds itself with three distinct 
missions: 

► Serving the White Flouse and NCS Member 
Agencies through its NS/EP mission; 

► Serving DFIS through its CIP mission; and 

► Fulfilling information sharing requirements through 
its information sharing and analysis function. 

History of NSTAC Actions and Recommendations 

The NSTAC has emphasized the importance 
of industry/Government coordination on NS/EP 
telecommunications since its inception over two 
decades ago. In its first report to the President 
in May 1983, the NSTAC recommended the 
development of the NCC—the operational arm for the 
NCM approved by Government a year earlier to assist 
industry and Government in coordinating NS/EP 
telecommunications services in times of emergency. 
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In 1984, the NSTAC followed this first report with 
Its National Coordinating Mechanism Implementation Plan to 
assist the Government In determining how best to 
execute the coordinating mechanism. 

Since that time, the NSTAC has periodically revisited 
the NCC both conceptually and operationally to 
evaluate its mission, information sharing procedures, 
and overall effectiveness as changes occurred in the 
threat, policy, and technological environments facing 
the telecommunications industry. For instance, in 
1987, the Committee's Telecommunications Systems 
Survivability (TSS) Task Force reviewed Government 
actions taken on the NCM recommendations 
and determined that the recommendations were 
carried out effectively. Furthermore, the task force 
determined that NCS member organizations’ 
representation in the NCC should continue. In its 
The NCC Intrusion Incident Reporting Criteria and Format 
Guidelines, the NCC Vision Task Force established 
standardized reporting criteria and outlined steps to 
improve NCC electronic intrusion report collection, 
processing, and distribution. 

In 1997, the Operations Support Group (OSG) 
worked closely with the NCS member organizations 
and NCC industry representatives to develop a 
common framework for assessing fhe Center’s 
ongoing role in NS/EP telecommunications. 

In its Operations Support Group Report, the NSTAC 
recommended that the President establish a 
mechanism within the Federal Government with 
which the NCC could coordinate on intrusion 
incident information issues, and with which 
NSTAC groups could coordinate the development 
of standardized reporting criteria. In 1999, 
the Information Sharing/Critical Infrastructure 
Protection (IS/CIP) Task Force investigated potential 
recommendations to be made in support of the 
goals outlined in PDD-63. As a result, the NSTAC 
issued numerous recommendations to the President 
including the development of mechanisms and 
processes for conducting protected, operational 
information sharing, the designation of the NCC 
as the telecommunications ISAC, the necessary 
continued interaction with Government leaders 


responsible for PDD-63 implementation, and the 
expansion of participation in the telecommunication 
ISAC during subsequent phases to include a 
broader spectrum of IT and communications 
industry companies. As a result, the Federal 
Government officially established the NCC as the 
Telecommunications ISAC in January 2000. 

Following the October 21, 2004, NSTAC Principals’ 
Conference Call, the Committee established the 
National Coordinating Center Task Force (NCCTF) 
to examine how best to balance both traditional 
network and cyber concerns and the changing 
national security environment to include homeland 
security concerns within the NCC moving forward. 
Specifically, the Principals requested that the task 
force examine the future mission and role of fhe 
NCC, including: 

► Flow should the industry members of fhe NCC 
confinueto parfnerwith Government? 

► Flow should the NCC be structured relative to the 
dual missions of CIP and NS/EP? 

► Flow does fhe new DFIS Sector Coordinating 
Council (SCO approach affect the NCC? 

Throughout 2005 and early 2006, the NCCTF 
deliberated on numerous issues, focusing its 
discussions on the NCC’s organizational structure, 
information sharing and analysis, leadership, 
incident management and response, and 
international mutual aid. To gain additional insight 
into incident management, and information sharing 
practices in particular, the task force co-hosfed an 
all-day incident management subject matter experts 
meeting with the NGNTF on August 30, 2005. The 
task force also internalized lessons learned from 
Flurricane Katrina response and recovery efforts 
including those derived by the White Flouse on 
improved industry and Government coordination in 
its The Federal Response to Hurricane Katrina: Lessons Learned 
report. Of particular interest and concern to the task 
force following Flurricane Katrina were questions 
related to the role of the NCC and the NCS in NS/EP 


12 



The President’s National Security Telecommunications Advisory Committee 


telecommunications planning and incident response 
as entities within the new DHS and command and 
control issues associated with Emergency Support 
Function (ESF) #2—Communications support 
agencies. The task force determined that better 
delineation of roles and responsibilities, especially 
with regard to data reporting and the prioritization 
and escalation of requesfs, would Improve Incident 
response and establish clearer points of confact to 
address Issues, reduce duplication of effort, and 
improve focus on fulfilling missions. 

Based on the NCCTF's analysis of issues facing the 
NCC, the NSTAC recommended that the President: 

► Direct the Secretary of Homeland Securify, fhe 
Director of fhe OSTP, the Secretary of Defense, 
and other ESF#2 Federal support agencies to 
develop and implement policies and procedures 
with respect to: (1) managing and escalating 
requests from the NCC, and (2) the delineation 
of authorities and responsibilities when ESF#2 

is invoked. 

► Direct the OSTP and the Homeland Security 
Council to join with the Communications SCC 
and the IT-SCC to support an industry-led task 
force with the primary goal of planning a regional 
communicafions and IT coordinating capability 
in the Gulf Coast and Southeastern regions prior 
to the 2006 hurricane season. Subsequently, 
the task force will determine the best approach 
fora long-term regional communications and IT 
coordinating capability that can serve all regions 
of the Nation. The task force should primarily 

be made up of industry representatives, as 
well as Federal, State, and local Government 
representatives. 

► Direct the Secretary of Homeland Security to 
expand the NCC to include both communications 
and IT companies and organizations. The NCC 
would be a cross sector industry/Government 
facility with a round-the-clock watch, and would be 
brought up to full strengfh during emergencies. 
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► Direct the Secretary of Homeland Security to 
engage the private sector in critical infrastructure 
protection activities by increasing the flow of 
fhreat information to the private sector, facilitating 
private sector participation in impact analyses, 
and clarifying policies for the protection of private 
sector Information. 

► Direct the Secretary of Homeland Security 
to improve the ESF#2 Emergency Response 
Training and Exercise program, with a focus on 
enhancing coordination among industry members 
and Federal, State, and local responders during 
incidents of national significance. This program 
should focus on sector Interdependencies for 
bofh physical and cyber fhreats, and would aim 
to produce actionable results. Industry must be 
involved from the earliest planning stages. 

► Encourage the Secretary of Homeland Security to 
improve the Federal Government’s cyber response 
strategy to delineate roles and responsibilities of 
Government and the private sector in the National 
Response Plan (NRP), aligning communications 
and cyber operations centers, and enhancing 
relationships with international computer 
emergency readiness teams. 

► Direct the Secretary of Homeland Security and 
other Government stakeholders to examine the 
value derived from fhe NCC collaboration and, 
if sufficiently supported, commit the resources 
necessary to strengthen and support the 
organization and its mission. 

To further these recommendations, the NCCTF 
developed an action item roadmap to assist the NCC 
in its efforts to address new issues and challenges 
over the next five years. 

For more information regarding the NCC’s 
development, please see the National Coordinating 
Mechanism, Information Sharing/Critical Infrastructure 
Protection, and the Industry/Government Information 
Sharing and Response sections in the Previously 
Addressed Issues section of this NSTAC Issue Review. 
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Reports Issued 

Cingular Wireless LLC 

Mr. Kent Bowen 

National Coordinating Mechanism Task Force Report, May 1983. 

Computer Sciences Corporation 

National Coordinating Mechanism Implementation Plan 
(Final Report), January 1984. 

Mr. Guy Copeland 

CTIA—The Wireless Association 

Telecommunications Systems Survivability Review of 

Government Actions in Response to NSTAC-Recommended 
Initiatives, June 1988. 

Mr. Christopher Guttman-McCabe 

Lockheed Martin Corporation 

Dr. Allen Dayton 

Operations Support Group Report, December 1997. 

Lucent Technologies (Bell Labs) 

Information Assurance Policy Subgroup of the Information 
Infrastructure Group and the National Coordinating Mechanism 
Subgroup of the Operations Support Group Joint Report: 
Information Assurance, December 1997. 

Mr. Richard Krock 

Microsoft Corporation 

Mr. Philip Reitinger 

Nortel 

Operations Support Group Report, September 1998. 

Dr. John S. Edwards 

Operations Support Group Report, June 1999. 

Qwest Communications International, Inc. 

Mr. Thomas Snee 

Information Sharing/Critical Infrastructure Protection 

Task Force Report, May 2000. 

Raytheon Company 

Mr. Frank Newell 

NSTAC Report to the President on the National 

Coordinating Center, May 2006 

Science Applications International Corporation 

Mr. Henry Kluepfel 

National Coordinating Center 

Task Force Membership 

The Boeing Company 

Mr. Robert Steele 

Verizon Communications, Inc. 

Mr. James Bean, Chair 

United States Telecom Association 

Mr. David Kanupke 

Sprint Nextel Corporation 

Mr. John Stogoski, Vice Chair 

VeriSign, Inc. 

Mr. Michael Aisenberg 

AT&T, Inc. 

Ms. Rosemary Leffler 

Mr. Harry Underhill 

Verizon Communications, Inc. 

Mr. Roger Higgins 

BellSouth Corporation 

Ms. Cristin Flynn Goodwin 
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Other National Coordinating Center 
Task Force Industry Participants 

BellSouth Corporation 

Mr. David Barron 

Cingular Wireless LLC 

Mr. James Bugel 

Microsoft Corporation 

Mr. Paul Nicholas 

Qwest Communications International, Inc. 

Mr. Jon Lofstedt 

Sprint Nextel Corporation 

Ms. Allison Growney 

Telecommunications Industry Association 

Mr. Daniel Bart 
Mr. David Thompson 

George Washington University 

Dr. Jack Oslund 

Verizon Communications, Inc. 

Ms. Ernie Gormsen 


Department of Homeland Security 

Mr. Thomas Falvey 
Mr. Jeffrey Glick 
Mr. Charles Lancaster 
Mr. Michael Lombard 
Mr. John O’Connor 
Mr. Don Smith 
Ms. Christina Watson 
CAPT Thomas Wetherald 

Federal Reserve Board 

Mr. Charles Madine 

General Services Administration 

Mr. John Migliaccio 
Mr. Thomas Sellers 

Office of Management and Budget 

Ms. Kim Johnson 

Office of Science and Technology Policy 

Ms. Linda Haller Sloan 
Mr. Mark LeBlanc 


National Coordinating Center 
Task Force Government Participants 

Department of Defense 

Ms. Hillary Morgan 

Department of Energy 

Mr. John Greenhill 
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Telecommunications and 
Electric Power Infrastructure 
Interdependencies 

Investigation / Period of Activity 

Electromagnetic Pulse Task Force 

September 27,1983-October 9,1985 

Telecommunications System Survivability Task Force 

March 6,1986-June 8,1989 

Energy Task Force 

August31,1988-March 29,1990 

Telecommunications and Electric Power 
Interdependency Task Force 

January 15,2005 - Present 

Issue Background 

For decades, professionals in the 
telecommunications industry have been concerned 
with the potential impact a sustained power grid 
outage would have on the telecommunications 
network. Recent events, Including the power outage 
in Eastern Canada in January 1998, the terrorist 
attacks of September 11, 2001, the Northeast 
blackout in August 2003, and the devastating 
hurricane seasons of 2004 and 2005, continued to 
draw attention to the interdependencies between 
the two sectors and re-energized industry and 
Government efforts to find strategies to both 
dampen the impact of and mitigate against 
further occurrences. In addition to man-made 
and natural threats to the infrastructure, changing 
trends in telecommunications network design 
also raise questions about the continued reliance 
of the telecommunications sector on electric 
power sources. With the growth of the NGN, the 
attendant increase in the use of wireless and 
mobile technologies, and the dispersion of network 
elements, the network and its users will increasingly 
rely on commercial electric service to supply 
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the necessary power. In this environment, the 
telecommunications and electric power sectors will 
increasingly be required to work together to ensure 
NS/EP services remain available to respond to 
terrorist incidents or natural disasters. 

History of NSTAC Actions and Recommendations 

NSTAC consideration of the interdependencies 
between the telecommunications and electric power 
sectors began in 1983 with the Committee’s response 
to a Government request for industry's perspective 
on the options available to industry and Government 
for improving the electromagnetic pulse (EMP) 
survivability of the Nation's telecommunications 
networks. Based on the analysis conducted by its 
EMP Task Eorce, the Committee provided several 
recommendations to the President on the issue in its 
Electromagnetic Pulse Final Task Force Report. 

The NSTAC gave further consideration to the 
interdependency between the telecommunications 
and electric power sectors when it reviewed the 
vulnerability of the telecommunications network to 
the loss of commercial electric power and presented 
its finding in its Telecommunications Systems Survivability 
Electric Power Survivability Status Report. As a follow-up to 
Its vulnerability analysis, the Committee established 
the Energy Task Force, which it charged with 
analyzing solutions to mitigate against the effects of 
electric power outages on telecommunications. In 
1988, the Energy Task Force, with participation from 
the Department of Energy (DOE), the NCS, and the 
North American Electric Reliability Council (NERC) 
undertook Its activities, examining interdependencies 
between the two sectors after a major earthquake. 

In October 1991, the NSTAC established a follow-on 
Energy Task Force and charged it to support the 
OMNCS in its efforts with DOE to develop criteria 
and a process for Identifying critical industry NS/EP 
telecommunications facilities that qualify for electric 
power restoration and priority fuel distribution. Based 
on the task forces analysis, the NSTAC issued its 
recommendations to the President on the issue in its 
Energy Task Force Final Report i n 1993. 
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Interdependency issues arose again as a resuit of 
extensive power and telecommunications outages 
during the hurricane season of 2004 in the southeast 
region of the U.S. Mr. F. Duane Ackerman, Chairman 
and Chief Executive Officer of BellSouth and NSTAC 
Chair, highlighted his concerns about the situation in 
his speech at the Research and Development Task 
Force’s October 2004 Research and Development 
Exchange (RDX) Workshop in Monterey, California. 
Due to the dependence of the telecommunications 
network on electric power services, Mr. Ackerman 
noted the need for enhanced and alternative 
emergency power technologies. In addition, as the 
network becomes increasingly distributed, he noted 
that issues of reliability and ease of communication 
and coordination between the telecommunications 
and electric power industries will become 
increasingly important during natural disasters or 
terrorist incidents. 

As a result, in 2005, the NSTAC established 
the Telecommunications and Electric Power 
Interdependency Task Force (TEPITF) to further 
evaluate how the telecommunications and electric 
power sector interdependencies will affect the future 
of the telecommunications network. The task force 
subsequently divided the work into two streams—an 
examination of the people and processes involved 
in national security communications and restoration 
and an evaluation of the technological implications of 
future events. 

Based on the completion of the first work stream, 
the NSTAC issued its People and Processes: Current State 
of Telecommunications and Electric Power Interdependencies 
Report in January 2006. In the report, the NSTAC 
recommended that the President direct his 
departments and agencies to: 

► Define and establish the term Emergency 

Responder within the NRP and other appropriate 
plans, guidance, directives, and statutes, 
including other local. State and Federal 
Government emergency plans; 


► Ensure key response personnel of critical 
infrastructure owners and operators in the 
telecommunications and electric power sectors be 
designated as Emergency Responders; 

► Include fuel supply, security, site access, and 
other required logistical support to critical 
telecommunications and electric power 
infrastructures as part of the Emergency 
Responder planning process to ensure priority 
restoration to critical telecommunications and 
electric power; 

► Eoster and promote effective emergency 
coordination structures to ensure reliable 
and robust communication between the two 
sectors and local, regional. State, and Federal 
Governments; 

• Review examples of proven priority restoration 
models at the State and regional levels. 
Encourage States and metropolitan regions 
without effective models to improve and 
update their existing frameworks; and 

• Encourage effective information sharing 
models at the local/regional Emergency 
Responder level, both in advance of a natural 
disaster and during the emergency restoration 
period. When developing these models, 
liability issues should be considered. 

The task force will continue exploring long-term 
interdependency issues, specifically developing a 
working definition for a long-term outage (LTO) and 
reviewing the possible implications of an LTO. The 
task force's conclusions will form the basis for the 
Committee’s final report and recommendations that 
will be submitted to the President in the fall of 2006. 

Eor further information on telecommunications and 
electric power interdependencies, please see the 
Infrastructure Interdependencies section in the 
Previously Addressed Issues section of this NSTAC 
Issue Review. 
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Actions Resulting from NSTAC Recommendations 

In response to the devastation caused by Hurricanes 
Katrina, Rita, and Wilma, the FCC established 
the Independent Panel Reviewing the Impact of 
Hurricane Katrina on Communications Networks. In 
its final report, the Panel expressed support for the 
NSTAC’s recommendation to establish a national 
standard for credentialing telecommunications repair 
workers as well as its recommendation to designate 
telecommunications infrastructure providers as 
“emergency responders" under the Robert T. Stafford 
Disaster Relief and Emergency Assistance Act, the NRP, 
and other legislative documents as appropriate. 

In addition, the FCC issued a Notice of Proposed 
Rulemaking requesting comments from industry 
on the recommendations found within its final 
panel report, including those recommendations 
made by the Committee. In addition, in July 2006, 

Mr. Robert Stephan confirmed to the NSTAC that 
DHS officials had been working closely with Congress 
to ensure that the Committee’s emergency responder 
provisions would be sufficiently addressed in future 
legislation to be formally introduced by the Senate. 

Furthermore, the DHS developed, in partnership 
with Federal, State, and local Government entities, 
as well as a private sector company, an access 
standard operating procedure (SOP) to ensure that 
private critical infrastructure responders receive 
priority access to disaster areas. The State of Georgia 
adopted the access SOP which is also currently 
being used as an example for other States. 

Reports Issued 

Electromagnetic Pulse Task Eorce Status Report, January 1984. 

Electromagnetic Pulse Pinal Task Eorce Report, July 1985. 

Telecommunications Systems Survivability Electric Power 
Survivability Status Report. Energy Task Eorce Einal Report, 
August 1988. 

People and Processes: Current State of Telecommunications and 
Electric Power Interdependencies, January 2006. 
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Telecommunications and Electric Power 
Interdependency Task Force Membership 

Nortel 

Dr. John S. Edwards, Chair 

AT&T, Inc. 

Ms. Rosemary Leffler 

Bank of America Corporation 

Mr. Roger Callahan 

BellSouth Corporation 

Mr. David Barron 

Computer Sciences Corporation 

Mr. Guy Copeland 

Lucent Technologies (Bell Labs) 

Mr. Richard Krock 

Lucent Technologies 

Mr. Karl Rauscher 

Microsoft Corporation 

Mr. Philip Reitinger 

Qwest Communications International, Inc. 

Mr. Jon Lofstedt 

Raytheon Company 

Mr. Frank Newell 

Science Applications International Corporation 

Mr. Henry Kluepfel 

Sprint Nextel Corporation 

Mr. William Hitchcock 

United States Telecom Association 

Mr. David Kanupke 

Verizon Communications, Inc. 

Mr. James Bean 
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Other Telecommunications and Electric Power 
Interdependency Task Force Industry Participants 

AT&T, Inc. 

Mr. Hariy Underhill 

American Public Power Association 

Mr. Michael Hyland 

BellSouth Corporation 

Mr. Shawn Cochran 

Cingular Wireless LLC 

Mr. Kent Bowen 

Edison Electric Institute 

Mr. Larry Brown 

Electric Power Research Institute 

Mr. Thomas Kropp 

Environmental Energy, Inc. 

Mr. Mark Razeghi 

George Washington University 

Dr. Jack Oslund 

Independent Electricity System Operator 

Mr. Stuart Brindley 

Industry Canada 

Mr. John Kluver 
Mr. Robert Laforest 
Mr. Robert Leafloor 

Institute for Defense Analysis 

Mr. Gordy Boezer 

Microsoft Corporation 

Ms. LynnTerwoerds 

MITRE 

Dr. Edward Jacques 

National Rural Electric Cooperative Association 

Mr. Barry Lawson 


New York Independent System Operator 

Ms. Bonnie Bushnell 

North American Electric Reliability Council 

Mr. Stanley Johnson 

Mr. Louis Leffler 

PEPCO, Holding Inc. 

Mr. Richard Kafka 

Public Safety and Emergency Preparedness Canada 

Ms. Patricia Davies 

Ms. Joan Edgan 

Public Service Enterprise Group 

Ms. Frances McCormick 

Qwest Communications International, Inc. 

Mr. Thomas Snee 

Southern Company 

Mr. Rusty Williams 

Sprint Nextel Corporation 

Ms. Allison Growney 
Mr. John Quigley 

Texas Utilities 

Mr. William Muston 

United States Telecom Association 

Mr. Murray Liebman 

United Telecom Council 

Ms. Jill Lyon 
Ms. Prudence Parks 

Verizon Communications, Inc. 

Mr. Roger Higgins 
Mr. Charles Romano 


20 


The President’s National Security Telecommunications Advisory Committee 


NSTAC XXIX Issue Review ► ACTIVE ISSUES 


Telecommunications and Electric Power 
Interdependency Task Force Government Participants 

Department of Energy 

Mr. John Greenhill 
Mr. Henry Kenchington 

Department of Homeland Security 

Ms. Michele Bruich 
Mr. David Delaney 
Lt. Col. Cheryl Edwards 
Mr. Cilberto Frederick 
Ms. Carolyn King 
Mr. Cabriel Martinez 
Mr. Chatry Perry 
Lt. Col. Joanne Sechrest 
Capt. Thomas Wetherald 
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Emergency Communications 
and Interoperability 

Investigation Group / Period of Activity 

Emergency Communications and Interoperability Task Force 

February 2006 - Present 

Issue Background 

Over the course of three months in the summer 
of 2005, the U.S. witnessed the catastrophic 
destruction of the Gulf Coast region’s 
telecommunications infrastructure as a result 
of Hurricanes Katrina, Rita, and Wilma. The 
unprecedented communications challenges 
posed by these hurricanes highlighted the fact 
that the existing components that comprise the 
communications infrastructure still lack sufficient 
levels of operability and interoperability when 
utilized by the multiple public and private response 
and recovery organizations they support during 
emergency communications situations. Hurricane 
Katrina alone impacted an area approximately 
90,000 square miles wide, disrupted service to 
approximately 3 million phone lines, and disabled 
first responder communications in multiple parishes. 
The lack of access prioritization to commercial 
networks for first responders crippled restoration 
efforts. As a result, the Initial lessons learned from 
these events highlight the importance of ensuring 
that Government continues to leverage the full suite 
of communications capabilities in its efforts to protect 
and ensure NS/EP telecommunications in the future. 

History of NSTAC Actions and Recommendations 

In response to concerns regarding the sufficient 
operability and interoperability of emergency 
communications systems during the 2005 hurricane 
season, the NSTAC established the Emergency 
Communications and Interoperability Task Force 
(ECITF) to develop recommendations regarding 
short-term interoperability solutions for responders 
in advance of the 2006 hurricane season. In 
addition, the Committee requested that the task force 
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investigate how a complete suite of communications 
technologies, including wireline, terrestrial wireless, 
broadcast, and satellite communications, should be 
integrated into the Federal Government’s emergency 
communications planning, and how they can more 
effectively support NS/EP activities; and to identify 
rapidly deployable interoperability solutions and 
recommend a strategic direction for the future that 
can assure a more survivable and interoperable 
nationwide communications architecture for 
responders. 

Based on the EClTF’s initial analysis, the NSTAC 
provided short-term recommendations in its 
March 2006 Letter to the President on Emergency 
Communications and Interoperability, which outlines 
emergency communications and interoperability 
issues and identifies immediately applicable actions 
to Improve responder communications capabilities. 
Specifically, the NSTAC recommended that the 
President direct the DHS to: 

► Establish a uniform protocol working with 
Federal, State, and local Governments that can 
dynamically Identify their emergency management 
coordinators’ contact information, especially during 
times when regular contact information is changed 
due to event situations, and a capability to share 
that information with DHS. 

► Accelerate efforts to create an initial deployable 
communications capability for the Gulf Coast region 
in accordance with Recommendation #37 of the 
February 2006 report. The Federal Response to Hurricane 
Katrina: Lessons Learned {Lessons Learned Report). 

► Formally integrate the NCS’ NS/EP priority programs 
into the National Emergency Communications Strategy 
pursuant to Recommendation #34 of the Lessons 
Learned Report. 

Additionally, the NSTAC recommended that the 
President direct the National Telecommunications 
and Information Administration to work In 
conjunction with the FCC to streamline the 
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authorization process for use of Federai incident 
response frequencies by the iarger non-Federal 
Government emergency response community. 

The task force wiil confinue to expiore these issues 
as weil as the need to deveiop recommendations on 
how to educate Federal Government departments 
and agencies, State and local Governments, 
first responders and emergency responders on 
technologies currently available to meet their NS/EP 
communications needs into the next cycle. Its 
conclusions will form fhe basis for a final report 
and recommendations that will be submitted by the 
NSTAC to the President in the fall of 2006. 

Actions Resulting from NSTAC Recommendations 

As a result of the devastation caused during the 
2006 hurricane season and informed by the 
NSTAC’s associated recommendations, the DEIS 
through the NCS has undertaken several actions 
to ensure successful emergency communications 
for future emergencies. The activities include the 
establishment of protocols for contacting and 
communicating with State and local officials, which 
is also intended to assist in the identification of 
emergency management and coordinators’ contact 
information; coordination of the creation of a 
deployable communications package to provide 
reliable communications to emergency responders 
at all levels of Government In a disaster-inflicted 
region; integration of NCS priority services programs, 
and other relevant recommendations. Into the Interim 
National Emergency Communications Strategy ma ndated 
by the White blouse’s The Federal Response to Hurricane 
Katrina: Lessons Learned report; and the development 
of an emergency communications asset tracking 
database to aggregate information on those public 
and private tools to be leveraged during disaster 
recovery operations. 

In addition, the NCS drafted an ESF #2 Operations 
Plan, which addresses deployable communications 
capabilities in support of incident response, specifically 
deployment of ESF#2 assets and capabilities to 
designated mobilizations centers and staging areas. 
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Termination of Cellular Networks 
During Emergency Situations 

Investigation Group / Period of Activity 

Cellular Service Shutdown Ad Hoc Working Group 

August 18,2005 - January 31,2006 

Issue Background 

As a direct result of the bombings that took piace 
in the London transportation system in July 2005, 

U.S. authorities initiated the shut down of cellular 
network services in the Lincoln, Holland, Queens, and 
Brooklyn Battery Tunnels. The Federal Government 
based this precautionary measure on the suspicion 
that similar attacks might also be perpetrated in the 
tunnels leading to and from New York City. Though 
the decision was rooted in vital security concerns, the 
resulting situation, undertaken without prior notice 
to wireless carriers or the public, created disorder 
for both Government and the private sector at a time 
when use of the communications infrastructure was 
most needed. Shortly following these activities, the 
NCC hosted a teleconference to discuss the need to 
develop a process for determining if and when cellular 
shutdown activities should be undertaken in the future 
in light of the serious impact these efforts could have 
had, not only on access by the public to emergency 
communications services during these situations 
but also on public trust in the communications 
infrastructure in general. 

History of NSTAC Actions and Recommendations 

These actions highlighted, within the NSTAC 
community, the need for a process to ensure that 
future similar decisions meet the Nation’s security goals 
and ensure the protection of critical infrastructures. 
Consequently, on August 18, 2005, the NSTAC 
established a Principal-level task force to formulate, on 
an expedited basis, recommendations to effect efficient 
coordinated action between industry and Government 
in times of national emergency. 
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To facilitate more coordinated action, the NSTAC 
recommended that the President direct his 
departments and agencies to: 

► Work to implement a simple process, building upon 
existing processes, with DHS/NCS coordination 
enabling the Government to speak with one voice, 
provide decision makers with relevant information, 
and provide wireless carriers with Government- 
authenticated decisions for implementation; and 

► Achieve rapid implementation through the 
Homeland Security Advisor of each State, in 
conjunction with the NCS and the Office of State 
and Local Government Coordination, DHS. 

The group concluded its activities upon NSTAC 
approval of the Letter to the President on Emergency Wireless 
Protocol and recommendations in January 2006. 

Actions Resulting from NSTAC Recommendations 

In support of the recommendations, the NCS 
approved SOP 303, “Emergency Wireless Protocols,” 
on March 9, 2006, codifying a shutdown and 
restoration process for use by commercial and 
private wireless networks during national crises. 

Linder the process, the NCC will function as the focal 
point for coordinating any actions leading up to and 
following the termination of private wireless network 
connections, both within a localized area, such as a 
tunnel or bridge, and within an entire metropolitan 
area. The decision to shutdown service will be 
made by State Homeland Security Advisors, their 
designees, or representatives of the DHS Homeland 
Security Operations Center. Once the request has 
been made by these entities, the NCC will operate as 
an authenticating body, notifying the carriers in the 
affected area of the decision. The NCC will also ask 
the requestor a series of questions to determine if 
the shutdown is a necessary action. After making the 
determination that the shutdown is no longer required, 
the NCC will initiate a similar process to reestablish 
service. The NCS continues to work with the Office 
of State and Local Government Coordination at DHS, 
and the Homeland Security Advisor for each State to 
initiate the rapid implementation of these procedures. 
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Legislation and Regulation 

Investigation Group / Period of Activity 

Funding and Regulatory Working Group 

December 1982 - December 1994 

Legislative and Regulatory Group 

December 1994 - September 23,1999 

Legislative and Regulatory Working Group 

September 23,1999 - February 14,2001 

Legislative and Regulatory Task Force 

February 15,2001 - Present 

Issue Background 

Laws and regulations govern the relationship 
between the Government and the public and provide 
the framework under which public and private 
entities conduct business. Thus, within the evolving 
telecommunications environment, it is essential 
that legislative and regulatory policies progress to 
ensure continued fulfillment of nafional securify and 
emergency preparedness (NS/EP) requiremenfs. If 
is within this context that the President’s National 
Security and Telecommunications Advisory 
Committee (NSTAC) reviews the legislative and 
regulatory activities underway within Government 
that could impact NS/EP services, operations, and 
communications and considers areas for which fhere 
is a need for furfher legislafive and regulatory acfion. 

History of NSTAC Actions and Recommendations 

The investigation of legislative and regulatory 
issues of consequence to NS/EP communications 
comprise a key focus for the NSTAC. Over the course 
of its existence, the committee has examined the 
implications of numerous important topics including: 

► Telecommunications Act of 1996 (Telecom Act); 

► Widespread Telecommunications Outages; 
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► National Services Planning Process; 

► Assessment of Eederal Critical Infrastructure 
Recommendations; 

► Information Sharing; 

► Transition to the Year 2000 (Y2K); 

► Wireless Communications; 

► Convergence; 

► Foreign Ownership; 

► Cyber Crime; 

► Potential Policy Conflicts with Plomeland Security 
and NS/EP Missions; 

► Open Source Information; 

► Support Anti-terrorism by Fostering Effective 
Technologies (SAFETY) Act; 

► Defense Production Act (DPA); and 

► Legislative Concerns Associated with the 
2005 Hurricane Season. 

A description of the NSTAC's activities in each of these 
areas, as well as the evolution of the task force follows. 

Task Force Evolution 

At its inaugural meeting in December 1982, the NSTAC 
established the Funding and Regulatory Working 
Group (FRWG) to examine funding alternatives and 
regulatory issues for candidate enhancemenfs fo NS/EP 
telecommunications. The FRWG remained active to 
address additional issues of a legislafive and regulatory 
nafure until 1994 when the committee decided to stand 
down the group until further issues arose requiring 
consideration. The NSTAC later amended the name 
of the FRWG to the Legislative and Regulatory Group 
(LRG) that same year per the guidance outlined in the 
December 1994 Industry Executive Subcommittee Guidelines; 
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however, it did not re-activate the LRG again untii 
January 1997 foilowing the passage of the iandmark 
Telecommunications Act of 1996. Between 1997 and 2001, 
the LRG was renamed the Legislative and Regulatory 
Working Group (LRWG) and was tasked to serve as an 
ad hoc group to investigate issues and also to serve 
as a supplementary body to NSTAC task forces. In 
February 2001, the committee again amended the task 
force's name to the Legislative and Regulatory Task 
Force (LRTF) and formally established it as a standing 
body of the NSTAC. 

Telecommunications Act of 1996 

As the first major overhaul of telecommunications 
policy since 1934, the Telecom Act redefined 
competition and regulation in virtually every sector 
of the communications industry. In response to 
passage of the Telecom Act and the resultant 
evolving telecommunications environment, the 
NSTAC charged the LRG to examine legislative, 
regulatory, and judicial actions that potentially impact 
NS/EP telecommunications, placing particular 
emphasis on monitoring implementation of the Act. 

In addressing this charge, the LRG established a 
framework for analysis, and in January 1997, began 
working closely with industry and Government to 
develop a common understanding of the NS/EP 
implications of the new law. 

Based on the analysis conducted by the task force, 
the NSTAC found that the Telecom Act did not alter 
carrier responsibilities for the provision of NS/EP 
services. Flowever, the committee determined that 
continued change in the regulatory and industry 
structure warranted increased educational outreach 
efforts for new entrants and existing carriers with 
regard to their mandatory and voluntary obligations. 

Widespread Telecommunications Outages 

At NSTAC XIX in March 1997, the Assistant to the 
President for Science and Technology asked the 
NSTAC to investigate the possibility of a widespread 
telecommunications outage. Subsequently, the LRG 
analyzed the legal and regulatory obstacles that 
would hinder service restoration during widespread, 
major service outages. As a result, the NSTAC 
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presented its related findings in its December 1997 
report discussed during NSTAC XX. The NSTAC 
found the most significant legal and regulatory 
obstacle to be the apparent uncertainty about who 
could expeditiously address carriers’ concerns 
regarding their compliance with relevant laws or 
regulations during emergency situations. 

To further address this finding, the NSTAC charged 
the LRG to examine options for enhancing 
communication on NS/EP matters among industry, 
the Eederal Communications Commission (FCC), and 
other relevant Government organizations. To that end, 
the LRG investigated the role of the FCC Defense 
Commissioner; investigated the need for an NS/EP 
industry advisory body to the ECC on these issues; 
documented the intergovernmental relationships 
between the ECC, the National Communications 
System, and the Office of Science and Technology 
Policy with regard to NS/EP responsibilities; and 
worked jointly with the NSTAC’s Network Group’s 
Widespread Outage Subgroup to draft procedural 
guidelines to help telecommunications carriers 
resolve issues with the FCC when critical emergency 
telecommunications services needed to be restored 
in a timely manner. 

National Services Planning Process 

In July 1997, the Network Reliability and 
Interoperability Council (NRIC) provided the FCC with 
a series of recommendations aimed at improving 
the planning process for National Services and 
deployable telecommunications services intended or 
required on a national or regional basis. The NSTAC 
agreed that a National Services planning process, as 
conceived by the NRIC, could serve as an effective 
means for promoting NS/EP telecommunications 
requirements. Consequently, the Committee tasked 
the LRG to assess what actions the NSTAC should 
take to ensure that Industry and Government 
consider NS/EP requirements during the National 
Services planning process. During discussion at 
NSTAC XX, the Committee reviewed the task force’s 
findings and recommended that the Industry 
Executive Subcommittee (lES) continue to assess 
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the development of the NRIC’s National Services 
recommendations. 

Following NSTAC XX, the LRG established the 
National Services Subgroup to study the feasibility 
of defining NS/EP telecommunications functions 
as National Services. The subgroup submitted 
its National Services Subgroup White Paper to NSTAC 
XXI in September 1998 geared to facilitating 
public awareness of selected NS/EP-critical 
telecommunications functions and capabilities. 

The white paper also promoted the continued 
consideration of NS/EP telecommunications service 
objectives by industry and Government during the 
future deployment of NS/EP National Services. 

Assessment of Federal Critical Infrastructure 
Recommendations 

In October 1997, the President’s Commission on 
Critical Infrastructure Protection (PCCIP) released 
its final report and recommendations on protecting 
the Nation’s critical infrastructures, including the 
telecommunications infrastructure. Following 
NSTAC XX, the NSTAC charged the LRG to review 
the potential legislative and regulatory implications 
for NS/EP telecommunications as a result of the 
PCCIP’s recommendations. To address its charge, 
the LRG conducted a preliminary analysis of 
Presidential Decision Directive (PDD) 63, Critical 
Infrastructure Protection, which the President issued on 
May 22, 1998, to support the PCCIP recommendations 
and to establish a national policy to eliminate 
vulnerabilities in the Nation’s critical infrastructures. 
Based on the LRG’s findings, the Committee requested 
that the lES undertake a more detailed assessment 
of the planned implementation of PDD-63 and report 
back to it regularly on progress made. 

Information Sharing 

Following NSTAC XXI, and in response to information 
sharing policy outlined in PDD-63, the NSTAC 
tasked the LRG to identify and assess the legal and 
regulatory obstacles to sharing outage and intrusion 
information. To that end, the LRG determined that 
identification and discussion of existing and proposed 
NS/EP-related outage and intrusion information 
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sharing mechanisms could provide additional insights 
to assist the group in assessing critical information 
sharing issues, particularly those associated with the 
implementation of PDD-63. As a result, and to better 
understand the information sharing environment 
and the entities involved in the process, the NSTAC 
developed its Telecommunications Outage and Intrusion 
Information Sharing Report which outlined the entities with 
whom telecommunications companies shared outage 
and intrusion information and reviewed potential legal 
barriers that could ultimately inhibit the information 
sharing process. 

During NSTAC XXIII, the NSTAC, through its LRWG, 
again examined information sharing issues, this time 
focusing on the impediments to information exchange, 
especially critical infrastructure information sharing. 

As a result, the LRWG undertook an in-depth analysis 
of The Freedom of Information /Icf (FOI A), exa m i n i ng FOI As 
potential to hinder industry information sharing with the 
Government. FOIA permits the public to request and 
gain access to records that Government departments 
and agencies maintain, the disclosure of which could 
deter industry from sharing further information with 
the Government. Although there are a number of 
exemptions to FOIA’s requirements for disclosure of 
information, none of the exemptions clearly covers 
information pertaining to critical infrastructure 
protection. The LRWG met several times with 
Department of Justice (DOJ) officials to exchange views 
on perceived problems including liability and antitrust 
concerns and potential legal solutions. As a result of 
the LRWG’s deliberations, the NSTAC agreed with 
DOJ representatives on the need for a nondisclosure 
provision to protect “security-related" information 
voluntarily shared with the Government. The LRWG 
shared its analysis with the NSTAC’s Information 
Sharing-Critical Infrastructure Protection Task Force, 
which addressed both the technical and legal and 
regulatory FOIA issues in its May 2000 Information 
Sharing-Critical Infrastructure Protection Task Force Report. 

NSTAC furthered its information sharing work during 
the NSTAC XXIV and XXV cycles. During this time, 
the committee requested the LRTF to examine 
pending FOIA legislation from the 106th and 107th 
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Congresses and to work with Congressional staff to 
determine the status and outlook of the legislation. 

In response to the analysis conducted by the LRTF, 
the NSTAC delivered a letter to President Bill Clinton 
on August 7, 2000, requesting his support on 
legislation that would protect critical infrastructure 
protection (CIP) information voluntarily shared with 
the Government from disclosure under FOIA and 
limit liability. Following the NSTAC XXIV Meeting in 
June 2001, the NSTAC acknowledged the continued 
importance of the topic and resubmitted the letter 
to President George W. Bush asking him to support 
such legislation. On September 26, 2001, President 
Bush replied that he supported a narrowly drafted 
exception to FOIA to protect information about 
corporations’ and other organizations’ vulnerabilities 
to information warfare and malicious hacking. In 
a December 17, 2001, letter to the President, the 
NSTAC encouraged the President to continue to 
support information sharing legislation. 

The LRTF continued to examine information sharing 
in the NSTAC XXVI and NSTAC XXVII cycles as well. 
During these cycles. Congress passed the Critical 
Infrastructure Information (CII)Act, which provided 
additional FOIA and liability protections for companies 
that voluntarily share critical infrastructure information 
with the Department of Plomeland Security (DFIS). 
Following enactment of the Cl I Act, the NSTAC 
requested the LRTF to assess whether additional 
information sharing barriers remained and to examine 
other legal and nonlegal barriers for the purposes of 
homeland security. As a result of the LRTF’s analysis, 
the NSTAC drafted its Barriers to Information Sharing 
Report, in which it made a series of recommendations 
for improving the exchange of Cll between industry 
and the Government and tor protecting voluntary 
Cll that critical infrastructure owners and operators 
provide to the Government. 

The Year 2000 Readiness and Disclosure Act 

In 1998, with the nearing arrival of the new century, 
the NSTAC tasked the LRG to examine relevant 
communications-related Y2K issues, particularly the 
success of the Year 2000 Readiness and Disclosure Act 
(Y2K Act) In urging greater information sharing within 
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industry. In response, the LRG sent a letter to the 
NSTAC’s lES representatives seeking their companies’ 
comments on the Y2K Act and any additional 
legislative or regulatory actions that could facilitate 
Y2K-related information sharing and remediation. Per 
request by the President’s Council on Y2K Conversion, 
the NSTAC forwarded a summary of the Committee’s 
findings in February 1999. 

Wireless Communications 

During NSTAC XXII, the NSTAC charged the LRG 
to identify the barriers to the issuance of wireless 
telecommunications priority access rules by the FCC 
and to evaluate NSTAC’s level of continued support 
ot the Cellular Priority Access Services (CPAS), 

(now referred to as the Wireless Priority Service). 
During the course of the LRG’s examination, the 
group learned that the NCS planned to implement a 
new approach for providing wireless priority access 
based on channel reservation, causing the NSTAC to 
conclude its study. 

Flowever, during NSTAC XXVI, the LRTF again 
engaged in wireless communications issues when the 
Wireless Task Force requested assistance from the 
LRTF in assessing the legal and regulatory aspects 
of the FCC Report & Order (R&O) on Priority Access 
Service (PAS). The LRTF reviewed the R&O and, 
after carefully considering the merits of reopening 
the PAS rulemaking, the task force concluded that 
revisiting the rules would be a lengthy process and 
could unintentionally slow the deployment of Wireless 
Priority Service (WPS). As a result of this conclusion, 
the NSTAC sent a letter to the President offering 
recommendations on how to facilitate the widespread 
deployment of wireless PAS. In the letter, the NSTAC 
commended the FCC for adopting a Second R&O 
for PAS, which indicates that carriers providing PAS 
shall have liability immunity from Section 202 of the 
Communications Act of 1934. The letter also stated that 
the FCC and the National Telecommunications and 
Information Administration should accelerate ongoing 
efforts to improve interoperability among Federal, State, 
and local public safety communications agencies. The 
letter further encouraged the Administration to support 
full and adequate Federal funding for wireless PAS. 
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Convergence 

During NSTAC XXII, the LRG reviewed convergence 
issues in light of legislative, regulatory, and judicial 
actions that might affect existing and future 
public networks and potentially impact NS/EP 
telecommunications. The LRG’s preliminary analysis 
of convergence revealed no significant implications 
for NS/EP telecommunications. 

During the NSTAC XXV cycle, the NSTAC tasked the 
LRTE to undertake a further analysis of convergence 
issues, examining whether the current legal and 
regulatory environment was adequate to ensure NS/EP 
services in the converged and NGN environment. To 
accomplish its tasking, the LRTE coordinated with 
participants in the Government’s Convergence Task 
Eorce to discuss the status of the Government's work 
in the area of network convergence and the assurance 
of NS/EP communications services. 

The LRTE concluded that until the standards 
for packet-based services were established and 
the Government’s requirements in the evolving 
environment were certain, new legislation or regulation 
was premature. The task force also stated that the 
legal issues underlying the provisioning of NS/EP 
priority services to the Eederal Government in an 
NGN environment were extremely complex and might 
require further study. Based on the convergence 
analysis conducted by the LRTE and the Network 
Security Vulnerability Assessments Task Eorce, the 
NSTAC issued its Network Security Vulnerability Assessments 
Task Force Report \n March 2002. 

Foreign Ownership 

During NSTAC XXIII, the NSTAC engaged the LRWG 
to conduct an examination of foreign ownership 
regulations and their possible Impact on NS/EP 
communications. The task force examined domestic 
regulatory history and analyzed several mergers 
and acquisitions between domestic and foreign 
telecommunications carriers, ultimately finding that 
the current regulatory structure satisfied the different 
interests of the industry and Government parties 
involved. The LRWG concluded that it was unclear 
whether further statutory or regulatory changes 
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would effectively enhance the role of national security 
Issues In foreign ownership situations at that time. 

The LRWG documented its findings in a working 
group paper and shared its analysis with the NSTAC’s 
Globalization Task Force (GTE). Based on the analysis 
conducted by the LRWG and the GTE, the NSTAC 
issued its Globalization Task Force Report in May 2000. 

Cyber Crime 

At the request of the NSTAC during cycle XXVI, 
the LRTE examined existing legal penalties for 
committing Internet attacks to determine whether 
those penalties should be strengthened or whether 
additional penalties were needed. In its Penalties 
for Internet Attacks and Cyber Crime Report, the NSTAC 
concluded sufficient legal authority exists to penalize 
and deter those who commit cyber crimes. The 
NSTAC also made additional recommendations for 
pursuing a well-rounded and proactive approach to 
combating cyber crime. 

Potential Policy Conflicts with Homeland Security 
and NS/EP Missions 

During the NSTAC XXVII cycle, and in response to 
an NSTAC request, the LRTE reviewed the policy 
landscape for national policies and regulations that 
could potentially conflict with homeland security 
and NS/EP missions. More specifically, the LRTE 
examined telecommunications policy conflicts 
related to fuel storage, water sector infrastructure, 
critical facilities markings, jurisdictional conflicts, 
and common underground facilities. The task force 
determined that policy conflicts existed due to the 
existence of overlapping and contradictory policies 
and regulations at the Federal, State, and local levels. 

In response to the LRTF’s analysis, the NSTAC sent 
a letter to President George W. Bush in October 
2003 recommending that he ask the Homeland 
Security Council, the National Security Council, 
and Federal departments and executive agencies, 
including independent agencies, to undertake 
several activities. These activities included evaluating 
proposed policies and regulations to ensure that 
homeland security and NS/EP implications have 
been consolidated; completing a review of existing 
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policies and regulations for potential cross-sector 
conflicts with homeland security and NS/EP priorities 
and working with DHS to promptly resolve any 
identified conflicts; and implementing a framework 
to resolve multijurisdictional (Federal, State, and 
local) conflicts and, if necessary, recommend an 
appropriate legislative resolution. 

Open Source Information 

In response to concerns that terrorists or other 
motivated adversaries could easily access sensitive 
information, such as the location of critical 
telecommunications facilities, on the Internet and 
use this information to plan an attack on the Nation’s 
telecommunications infrastructure, the NSTAC tasked 
the LRTF to undertake an analysis of open source 
information. The LRTF completed its analysis during 
the NSTAC XXVIII cycle, and on April 8, 2005, the 
NSTAC sent a letter to President Bush recommending 
various activities including the development and 
adoption of Web publishing and access guidelines 
by the Federal Government incorporating provisions 
that protect industry-sensitive critical infrastructure 
information provided to the Government and the 
promulgation of web publishing and access guidelines 
for dealing with sensitive but unclassified critical 
infrastructure information. 

The LRTF’s work on open source information 
continued during the NSTAC XXIX Cycle, when the 
NSTAC, during the March 10, 2005, Principals’ 
Conference Call, requested that the LRTF address 
the concern of open source information on academic 
web sites and report back to them about the 
advisability of scoping this issue. After conducting 
its analysis, the LRTF reported back to the Principals 
that the issue did not require further scoping. 

SAFETYAct 

During the NSTAC XXVIII Cycle, the LRTF initiated 
an examination of the NS/EP telecommunications 
implications of the implementation of the SAFETY 
Act at the request of the Committee. The LRTF 
continued to monitor the implementation of the 
SAFETY Act in the NSTAC XXIX Cycle, reporting to 
the NSTAC periodically on the status of the efforts. 
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Defense Production Act 

During NSTAC XXVIII, the NSTAC commissioned 
the LRTF to begin an examination of the NS/EP 
implications of the DPA and the proposed amendments 
to the Act and to Executive Order (E.O.) 12919, National 
Defense Industrial Resources Preparedness. During the NSTAC 
XXIX cycle, the task force agreed to continue to monitor 
potential amendments to the DPA and to E.O. 12919 
to ensure essential NS/EP needs are met in any 
revision to law. 

Legislative Concerns Associated with the 
2005 Hurricane Season 

The 2005 hurricane season defined many of the 
Committee’s legislative and regulatory priorities during 
the NSTAC XXIX Cycle. The Government’s response 
to Hurricanes Katrina, Rita, and Wilma prompted the 
NSTAC to request assistance from the LRTF to review 
the legal and regulatory environment in which Federal 
response took place. The LRTF analysis revealed 
that several legislative mechanisms needed revision 
including the Robert T. Stafford Disaster Relief and Emergency 
Assistance (Stafford) Act which the Committee felt did not 
adequately provide assistance to telecommunications 
infrastructure providers (TIPs) in disasters. The task 
force also determined that difficulties carriers faced 
in obtaining security, fuel, water, site access, and 
billeting for workers could be mitigated if the Federal 
Government created a designation for “Emergency 
Responders (Private Sector)’’ and included TIPs in 
that category. Accordingly, the NSTAC sent a letter 
to President Bush advising him to act no later than 
June 1, 2006, to establish and codify the term 
“emergency responder (private sector)’’ to include 
TIPs and ensure they receive non-monetary assistance, 
including accessing restricted areas and obtaining 
fuel, water, power, billeting, and workforce and asset 
security, by: 

► Directing DHS to modify the National Response 
Plan and its emergency support functions to 
designate TIPs as Emergency Responders 
(Private Sector) and to establish protocols and 
procedures for the way in which Federal, State, 
local, and tribal Governments should work with 
TIPs before, during, and after a national disaster; 
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► Issuing appropriate Presidential guidance to 
define Emergency Responders (Private Sector) 
under the Stafford Act and other authorities as 
appropriate to align with the broadened definition 
of national defense in the 2003 amendments 

to the DPA. Specifically, the guidance should 
make clear that key response personnel of critical 
telecommunications infrastructure owners and 
operators should be defined as Emergency 
Responders (Private Sector) and should receive 
non-monetary Federal assistance under the 
Stafford Act, and 

► Directing the Secretary of Homeland Security to 
work with Congress to align the Stafford Act and 
other appropriate legislative authorities with the 
DPA by codifying the designation of private sector 
TIPs as Emergency Responders (Private Sector) 
and by codifying the official interpretation that 
for-profit TIPs should receive Federal assistance. 

Actions Resulting from NSTAC Recommendations 

In the Barriers to Information Sharing Report, the NSTAC 
advised the President that DHS should be the 
clearinghouse and dispenser of Cl I information and 
that Cl I Act protections should cover departments 
and agencies other than DHS. In a related action, 
on February 18, 2004, DHS launched the Protected 
Critical Infrastructure Information (PCII) Program, 
pursuant to the Cl I Act. The PCII Program Office 
(PO) is located within the DHS Preparedness 
Directorate and serves as the clearinghouse and 
dispenser of Cll. 

Furthermore, on October 28, 2003, in response to 
the NSTAC’s Letter to President George W. Bush on National 
Policies and Regulations that Conflict with Homeland Security 
andNS/EPMissions, the Assistant to the President for 
Homeland Security confirmed that the staff of the 
Executive Office of the President had been tasked 
to convene a meeting with the other White House 
stakeholders to review the recommendations in the 
NSTAC’s letter and to analyze their impact to NS/EP 
communications. 
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Finally, in July 2006, Secretary Chertoff confirmed 
to the NSTAC that DHS officials had been working 
closely with Congress to ensure that the Committee’s 
emergency responder provisions would be 
sufficiently addressed in future legislation to be 
formally introduced by the Senate. In addition, the 
DHS announced it had developed, in partnership 
with Federal, State, and local Government entities, as 
well as a private sector company, an access standard 
operating procedure (SOP) to ensure that private 
critical infrastructure responders have priority access 
to disaster areas. The access SOP had been adopted 
by the State of Georgia and would be used a model 
for other States. 


Reports Issued 

Legislative and Regulatory Group Report, December 1997. 

Legislative and Regulatory Group Report, September 1998. 

Procedure for Problem Resolution with the Federal 
Communications Commission and the National Coordinating 
Center for Telecommunications During Emergency 
Telecommunications Disruptions, September 1998. 

National Services Subgroup White Paper, September 1998. 

Legislative and Regulatory Group Report, June 1999. 

Telecommunications Outage and Intrusion Information 
Sharing Report, June 1999. 

Letter to President Bill Clinton on Protection of Critical 
Infrastructure Information, August 7, 2000. 

Letter to President George W. Bush on Protection of Critical 
Infrastructure Information, June 2001. 

Penalties for Internet Attacks and Cyber Crime, April 2003. 

Barriers to Information Sharing, September 2003. 
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Letter to President George W. Bush on National Policies 
and Regulations that Conflict with Homeland Security and 
NS/EPMissions, October 16, 2003. 

Letter and Addendum to President George W. Bush on Open 
Source Critical Infrastructure Information, April 8,2005. 

Letter and Report to President George W. Bush on Federal 
Support to Telecommunications Infrastructure Providers During 
National Emergencies, Designation as Emergency Responders 
(Private Sector), January 31, 2006. 
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Research and Development 

Investigation Group / Period of Activity 

Network Security Task Force 

February 21,1990-August 26,1992 

Network Security Group 

December 1994 - April 22,1997 

Network Group, Intrusion Detection Subgroup 

April 22,1997-September 23,1999 

Research and Development Exchange Task Force 

April22,1997-July29, 2003 

Research and Development Task Force 

July 29,2003 - Present 

Issue Background 

In today’s global economy, advances In 
communications transform the way in which people 
live, work, iearn, converse, and conduct business. 
Research is essential to ensure these transformations 
are productive for society, beneficial for the economy, 
and sustainable over the long term. Communications 
and information technology research and development 
(R&D) advances the digital technologies that power 
critical national security and emergency preparedness 
(NS/EP) capabilities. A strong, collaborative R&D 
program advances the resilience of telecommunications 
and information systems. Therefore, the President’s 
National Security Telecommunications Advisory 
Committee (NSTAC) examines areas for future 
development and seeks to enhance coordination 
between the public and private sectors and the 
academic research community. 

History of NSTAC Actions and Recommendations 

Periodically, the Research and Development Task 
Force (RDTF) of the NSTAC’s Industry Executive 
Subcommittee (lES) conducts its Research and 
Development Exchange (RDX) Workshop, the broad 
purpose of which is to stimulate and facilitate a 
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dialogue among industry, Government, and academia 
on emerging security technology R&D activities that 
have the potential to both positively and negatively 
affect the NS/EP posture of the Nation. To ensure 
inclusion of all stakeholders in the R&D community, 
the RDTF traditionally invites representatives from 
a broad number of private sector companies, 
academic institutions, and key Government agencies 
with NS/EP and/or R&D responsibilities such as the 
Office of Science and Technology Policy (OSTP), 
the Defense Advanced Research Projects Agency 
(DARPA), the National Institute of Standards 
and Technology (NIST), and the Department of 
Homeland Security’s (DHS) Directorate for Science 
and Technology. Over the course of the Workshop, 
participants endeavor to frame key policy issues; 
identify and characterize barriers and impediments 
inhibiting R&D; discuss how stakeholders can 
cooperate and coordinate efforts as the communities 
of interest shift; and develop specific and realistic 
recommendations for further action by key 
stakeholders and decision makers. 

The RDX Workshops date back to 1990 when 
the growing prevalence of hacker incidents led 
to the formation of the NSTAC’s Network Security 
Task Force (NSTF). The task force’s purpose was 
to assess the threats to and the vulnerabilities 
of the public switched telephone network. A key 
component of the task force’s work included 
examining R&D issues related to security with a 
particular emphasis on improving commercially 
applicable tools. 

In mid-1991, the NSTF identified six areas in which 
R&D on commercially applicable security tools 
was needed and asked the Government to share 
information about its R&D efforts in those areas. The 
subsequent briefings provided by representatives 
of the National Security Agency and NIST to the 
NSTAC, which constituted the NSTAC’s first RDX 
Workshop, demonstrated that Government already 
had R&D efforts under way in all of those areas. 

NSTAC R&D activities gained momentum again in 
March 1996 when the NSTAC’s Network Security 
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Group (NSG) facilitated a seminar for industry 
and Government to discuss network security R&D 
activities and issues. The purpose of the seminar 
was threefold: (1) provide a common understanding 
of network security problems affecting NS/EP 
telecommunications; (2) identify R&D activities in 
progress to address those problems; and (3) identify 
additional network security R&D activities needed. 

The NSG identified four areas of interest for further 
investigation from the seminar—authentication, 
intrusion detection, integrity, and access control— 
upon which it conducted the second RDX Workshop 
on September 18, 1996. Because the objective 
was to facilitate meaningful discussion among 
participants, participation at the Workshop was 
limited to 50 people representing 15 companies and 
11 Government organizations, including one federally 
funded research and development center. The 
Committee limited industry representation to NSTAC 
member companies only. 

In 1997, in response to a number of stimuli, 
including the recommendations from the 1996 RDX 
Workshop, the Network Group (NG)—formerly the 
NSG—conducted a study of intrusion detection 
technology R&D and analyzed it in terms of meeting 
NS/EP requirements. As a result of the analysis, 
the NSTAC made four recommendations to the 
President, including the need to increase R&D 
funding for control systems of critical infrastructures 
and to encourage cooperative development programs 
to maximize the use of existing R&D resources in 
industry, Government, and academia. The NSTAC's 
recommendations reinforced prior Committee 
recommendations to examine the need for and 
feasibility of collaborative R&D approaches for 
security technology. It also provided the basis for the 
concept of the third RDX Workshop, Enhancing Network 
Security Technology: R&D Collaboration, held in October 
1998 at Purdue University’s Center for Education 
and Research in Information Assurance (lA) and 
Security to examine collaborative approaches to 
security technology R&D. The participants, which 
for the first time included members of the academic 
community, also discussed the need to train more 
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information technology (IT) security professionals, 
create large-scale test beds to test security products 
and solutions, and promote the creation of lA 
Centers of Excellence in academia. 

Deliberations at the RDX Workshop at Purdue 
University resulted in several findings and 
recommendations for future Industry, Government, 
and academic work. Discussions also noted three 
recommendations for future NSTAC consideration, 
including the need to, “conduct another R&D 
Exchange in the spring of 2000 to continue the 
dialogue on the long-term issues associated with 
infrastructure assurance and network security,” such as 
new threats and convergence. The third RDX Workshop 
also provided the model for all future workshops. 

Held at the University of Tulsa in September 2000, 
the fourth RDX Workshop examined issues of 
transparent security in a converged and distributed 
network environment. Attendees discussed the need 
to address the shortage of qualified information 
security professionals, expand the number of 
universities participating in the lA Centers of 
Excellence program, and promote best practices, 
standards, and protection profiles to enhance the 
security of the NGN. Eindingsand recommendations 
from the Workshop included the establishment of 
NSTAC task forces to address standards and best 
practices for network security. 

The fifth Workshop held in March 2003 at the Georgia 
Tech Information Security Center (GTISC) at the 
Georgia Institute of Technology in Atlanta, Georgia, 
explored the full range of telecommunications and 
information systems trustworthiness issues as they 
pertained to NS/EP telecommunications systems. 
Specifically, the attendees examined trustworthiness 
from four different perspectives: cyber and software 
security, physical security. Integration Issues, and 
human factors. Erom this event, the RDTE developed 
seven specific findings including the need to clearly 
define the term NS/EP in a post-September 11, 2001, 
world characterized by a rapidly changing technology 
and threat environment and the need for a large-scale 


42 



The President’s National Security Telecommunications Advisory Committee 


testbed that could be used as an environment to test 
NS/EP systems and critical infrastructures. 

To directly address the findings from the 2003 
RDX Workshop during the NSTAC XXVII cycle, 
the RDTF developed a “living” discussion paper 
providing the background for fhe policy components 
of the evolving definition of NS/EP. The RDTF 
also examined several large-scale public and 
privafe fesfbeds, reviewing fheir capacify fo fest 
the telecommunications and information systems 
infrastructures for NS/EP purposes. As a resulf, 
the NSTAC finalized recommendations for a joinf, 
collaborative, distributed industry. Government, 
and academia pilot testbed that could advance the 
current state of NS/EP and crifical infrastrucfure 
profection infegrafion activities. 

The most recent Workshop, held in Monterey, 
California in October 2004, reconsidered the 
R&D issues associated with trustworthy NS/EP 
telecommunications addressed at the 2003 RDX 
Workshop and examined progress made, unfinished 
work, and new challenges. Participanfs again 
focused on major cyber and soffware, physical, 
human factor, and integration research issue areas 
and discussed the need for information exchange 
and collaboration efforts within the R&D community. 

At the 2004 Workshop, participants resoundingly 
agreed that embedding strong, ubiquitous 
authentication and identity management 
technologies into future networks was critically 
important. As a result of fhis discussion, the NSTAC 
is currently evaluating whether it should conduct an 
analysis of idenfify management security concerns 
unique to NS/EP telecommunications. 

The task force is also planning ifs firsf-ever 
international Workshop in Ottawa, Ontario, Canada 
on September 21-22, 2006. The Workshop will focus 
on international multilateral collaborative R&D to 
enhance security on the network. 
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Actions Resulting from NSTAC Recommendations 

Following the 2003 RDX Workshop in Atlanta, 
Georgia, the RDTF provided the Director, OSTP with 
policy advice on specific areas of security technology 
R&D that should be taken into account when 
providing input to the President's fiscal year 2004 
budgef request. The RDTF also provided its NS/EP 
Definition Discussion Paper to the Executive Office of 
the President to utilize in on-going discussions on 
NS/EP communications. 


Reports/Proceedings Issued 

Network Security Research and Development Exchange 
Proceedings, September 1996. 

Report on the NS/EP Implications of Intrusion Detection 
Technology Research and Development, December 1997. 

Research and Development Exchange Proceedings: 

Enhancing Network Security Technology R&D Collaboration, 
October 20-21,1998. 

Research and Development Exchange Proceedings, Transparent 
Security in a Converged and Distributed Network Environment, 
September 28-29, 2000. 

Research and Development Exchange Proceedings, R&D 
Issues to Ensure Trustworthiness in Telecommunications and 
Information Systems that Directly or Indirectly Impact National 
Security and Emergency Preparedness, March 13-14, 2003. 

NS/EP Definition Discussion Paper, April 2004. 

Research and Development Exchange Proceedings, 

A Year Later: R&D Issues to Ensure Trustworthiness in 
Telecommunications and Information Systems that Directly 
or Indirectly Impact National Security and Emergency 
Preparedness, October 28-29, 2004. 

The Critical Importance of Testbeds for NS/EP R&D, May 2005. 
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Automated Information 
Processing 

Investigation Group / Period of Activity 

Automated Information Processing (AlP) Task Force 

December 14,1982-December 12,1984 

Issue Background 

The need to ensure a survivable AlP capability 
to support NS/EP telecommunications prompted 
the NSTAC to initiate a study of the AlP issue on 
December 14, 1982. The AlP Task Force addressed 
the issue for nearly 2 years. 

History of NSTAC Actions and Recommendations 

In July 1983, NSTAC II recommended that the 
President direct the National Security Council, in 
conjunction with industry, to identify essential NS/EP 
functions and their dependence on AlP, and to rank 
those functions in order of priority on a time-phased 
basis. In April 1984, NSTAC III recommended 
that the President establish an AlP vulnerability 
awareness program within the Government. On 
December 12, 1984, NSTAC IV forwarded fhe 
following AlP recommendations to the President: 

► Establish a full-time management entity to 
implement the telecommunications AlP 
survivability effort; 

► Conduct AlP vulnerability awareness programs in 
conjunction with the private sector; 

► Develop NS/EP AlP policy; 

► Initiate efforts to enhance the survivability of 
NS/EP AlP in general; and 

► Provide fhe necessary funding and develop 
incentives for AlP survivability enhancements. 

The TSS Task Force worked on the AlP issue. It 
reviewed the Government’s responses to the NSTAC 
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IV’s AlP recommendations. On September 22, 1988, 
the NSTAC approved and forwarded the TSS Task 
Force findings and recommendations on AlP to 
the President. 

Actions Resulting from NSTAC Recommendations 

The TSS Task Force reviewed the Government’s 
responses to the NSTAC’s AlP recommendations. 
The task force found fhe Commercial Nefwork 
Survivability program was addressing the 
recommendations regarding AlP embedded in 
telecommunications, but the Government had not 
implemented the recommendations on AlP for 
telecommunications operational support and AlP 
required to support 

NS/EP functions in general. The TSS Task 
Force recommended the Government consider 
the implications of all operational support AlP, 
especially for network management, restoration, 
and reconstitution; and that the Government 
implement an NS/EP AlP awareness program. The 
NSTAC approved the TSS Task Force’s findings and 
recommendations on AlP and forwarded them to the 
President on September 22, 1988. 

Reports Issued 

Working Group Proceedings on AlP Survivability, October 6,1982. 

AlP Task Force Report, June 1983. 

Strategy and Recommendations for Achieving Enhanced NS/EP 
AlP Survivability, October 25,1984. 

Einal Report Addendum, May 1,1985. 
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Commercial Network Survivability 

Investigation Group / Period of Activity 

Commercial Network Survivability (CNS) Task Force 

February 29,1984-October 9,1985 


Issue Background 

In September 1983, the NSTAC lES reviewed the 
issues associated with telecommunications systems 
survivability and decided its scope was too broad for a 
single task force to address. The lES requested that the 
Resource Enhancements Working Group (REWG) and 
the Emergency Response Procedures Working Group 
(ERPWG) meet to discuss and refine the issues. The 
REWG and ERPWG met on November 9, 1983. They 
suggested establishing the CNS Task Force to develop 
and prioritize initiatives to enhance the survivability of 
the terrestrial portion of commercial carrier networks. 
The lES initiated the assessment of the CNS issue on 
February 29, 1984. It formed the CNS Task Force and 
instructed it to improve the survivability of commercial 
communications systems and facilities, and identify 
initiatives to improve interactive emergency response 
capabilities among the commercial networks. 

History of NSTAC Actions and Recommendations 

On October 9, 1985, the NSTAC forwarded five CNS 
recommendations to the President regarding: 

► Specification of survivability requirements for 
NS/EP services; 

► Development of NS/EP network architecture plans; 

► Development of plans and procedures for network 
emergency operations; 

► Acquisition and maintenance of databases; and 

► Government participation in standards 
organizations. 

The President endorsed those initiatives, and 
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the OMNCS undertook a CNS program. On 
November 6, 1987, the NSTAC approved the TSS 
Task Force’s findings and recommendations on CNS 
and forwarded them to the President. 

Actions Resulting from NSTAC Recommendations 

The TSS Task Force reviewed Government actions 
taken on the NSTAC’s CNS recommendations. 

The task force found the Government’s actions 
focused on the highest threat level, but the 
Government had taken no action on the CNS Task 
Force recommendation to form a joint industry and 
Government group to develop network architecture 
plans. The TSS Task Force recommended that the 
CNS program be expanded to include the entire 
threat spectrum and all NS/EP users. 

The OMNCS established a CNS Program Office 
which engineered and implemented enhancements 
in the PSN for NS/EP disaster recovery 
communications use during regional emergencies 
and national crises. The CNS Program Office 
evaluated the effectiveness ot those enhancements 
by modeling the anticipated effects of natural 
disasters and wartime scenarios using computer 
simulations and through proof-of-concept testing. 

The OMNCS used its computer modeling capabilities 
and extensive database containing detailed 
information on the structure of the PSN to assess 
the CNS enhancements. Enhancements included 
dedicated leased lines in the local exchange carrier 
networks to provide alternate, survivable routes 
for NS/EP communications. The program office 
expected future enhancements to use advanced 
technology service offerings from those same carriers 
and from cellular service providers and competitive 
access providers. 

The Mobile Transportable Telecommunications 
(MTT) program, an associated effort, demonstrated 
reconnecting isolated portions of the PSN using 
standard military radio equipment. The MTT 
program performed these demonstrations with 
National Guard equipment and participation. The 
CNS Program Office worked with other National 
Level NS/EP Telecommunications Program 
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(NLP) elements to ensure interoperability of CNS 
network enhancements with other NLP component 
programs, such as Commercial Satellite Command 
Interconnectivity and the Government Emergency 
Telecommunications Service. In September 1994, 
the CNS program was terminated due to budget 
constraints. 


Reports Issued 

CNS Task Force (Interim) Report, December 6,1984. 
CNS Task Force Final Report, August 1985. 
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Commercial Satellite Survivability 

Investigation Group / Period of Activity 

Commercial Satellite Survivability (CSS) Task Force 

December 1982 - April 1984 
June 1988 - March 1990 

Satellite Task Force (STF) 

September 2003 - January 2004 

Issue Background 

At its first formal meeting on December 14, 1982, 
the NSTAC agreed to emphasize commercial 
satellite communications survivability initiatives. 

The NSTAC directed the CSS Task Force 
Resource Enhancements Working Group to 
assess the vulnerabiiity of the commerciai sateliite 
communications network and the enhancements to 
the NS/EP 

telecommunications infrastructure that the use of 
commercial carrier satellites and Earth terminals 
could provide. A separate CSS Task Eorce reviewed 
a set of specific satellite initiatives selected for 
implementation, developed an implementation 
concept, and prepared a report of its actions and 
recommendations for the NSTAC. 

In June 1988, the NSTAC lES reactivated the CSS 
Task Eorce to review the proposed objectives and 
implementation initiatives of the commercial satellite 
communications (SATCOM) Interconnectivity (CSI) 
Phase II Architecture and offer recommendations. 

The NSTAC concurred with this action in 
September 1988. 

In March 1990, the NSTAC approved the final report 
of the reactivated CSS Task Eorce, which concluded 
that the CSI Phase II Architecture approach was 
reasonable, and made several recommendations to 
the Government. 
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The terrorist attacks on Septemberll, 2001, raised 
security concerns about the protection of the 
Nation’s vital telecommunications systems against 
threats, and raised awareness that a Federal program 
did not exist to ensure NS/EP communications via 
commercial satellite systems and services. 

In January 2003, the Director, National Security 
Space Architect, requested that the President’s 
NSTAC consider embarking on a study of 
infrastructure protection measures for SATCOM 
systems. In response, the NSTAC’s lES formed the 
STE. The STF was established to: 

► Review applicable documentation that addresses 
the vulnerabilities of the commercial satellite 
infrastructure; 

► Define potential policy changes that have to be 
made to bring the infrastructure into conformance 
with a standard for mitigating the vulnerabilities; 

► Consider Global Positioning System timing 
capabilities during the deliberations; 

► Coordinate this response with representatives 
from the NCS; and 

► Draft a task force report with findings and 
Presidential recommendations. 

History of NSTAC Actions and Recommendations 

At its first formal meeting on December 14, 1982, 
the NSTAC established the CSS Task Force to 
review a set of specific satellite initiatives selected 
for implementation, develop an implementation 
concept, and prepare a report of its actions and 
recommendations for the NSTAC. 

In September 1988, the NSTAC concurred with the 
lES June 1988 reactivation of the CSS Task Force to 
review the proposed objectives and implementation 
initiatives of the CSI Phase II Architecture and offer 
recommendations. 
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In March 1990, the NSTAC approved the final 
report of the reactivated CSS Task Force. The 
report concluded that the CSI Phase II Architecture 
approach was reasonable and it recommended 
the Government: 

► Include Ku-band assets in the CSI program to 
provide “access;” 

► Augment selected large Ku-band earth stations 
and control facilities to provide Ku-band 
interoperability; 

► Use very small aperture terminal technology to 
restore selected trunking between interexchange 
carrier switches and local exchange carrier end 
offices, and selected users in the United States 
to access the PSN via direct connection at an 
access tandem; and 

► Pursue investigations, analyses, and 
augmentations necessary to ensure NS/EP 
telecommunications service can be extended 
from the United States to NS/EP users overseas. 

The NSTAC also approved several specific 
recommendations to the Government regarding the 
use and augmentation of safellife assets to achieve 
various types of connectivity. 

In January 2003, the Director, National Security 
Space Architect, requested that the President’s 
NSTAC conduct a study of infrastrucfure profection 
measures for SATCOM sysfems. In response, fhe 
NSTAC’s lES formed the STE to analyze and assess 
SATCOM systems’ vulnerabilities and make policy 
recommendations to the President on how the 
Federal Government should work with industry to 
mitigate vulnerabilities to the satellite infrastructure. 

The STF engaged broad participation from 
representafives of NSTAC member companies, 
non-NSTAC commercial satellite owners and 
operators, commercial satellite trade associations. 
Government agencies, and technical experts. The 
STF concluded its analysis of safellite security in 


January 2004 and presented its findings in the STF 
Report. On the basis of ifs analysis and review of 
related policy issues, the NSTAC offered the following 
recommendations to the President: 

► Direct the Assistant to the President for Nafional 
Security Affairs, Assistant to the President for 
Flomeland Security, and Director, Office of 
Science Technology Policy, fo develop a national 
policy with respect to the provisioning and 
management of commercial SATCOM services 
integral to NS/EP communications, recognizing 
the vital and unique capabilities commercial 
satellites provide for global military operations, 
diplomatic missions, and homeland security 
contingency support; 

► Eund the Department of Flomeland Securify 
fo implemenf a commercial SATCOM NS/EP 
improvemenf program within the NCS to 
procure and manage the non-Department of 
Defense satellite facilities and services necessary 
to increase the robustness of Government 
communications; and 

► Appoint several members to represent service 
providers and associations from all sectors of fhe 
commercial safellife industry to the NSTAC to 
increase satellite industry involvement in NS/EP. 

Actions Resulting from NSTAC Recommendations 

The TSS Task Force reviewed the Government 
actions taken on the NSTAC’s CSS Task Force 
Phase I recommendations and found thaf fhe CSI 
Program and the Industry Information Security Task 
Force were pursuing most of the CSS initiatives. The 
TSS Task Force recommended that three aspects 
of the CSS initiatives be studied further: Ku-band 
interoperability, up-link jamming protection, and 
transportable terminals. 

The first CSS Task Force’s investigations resulted 
in the definition of 12 initiafives for improving the 
survivability and robustness of commercial satellite 
communications resources. The investigations also 
resulted in the incorporation of the CSS Program 
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Office, established in November 1984, as the CSI 
Program Office in 1987. In addition, the CSS Task 
Force approved the CSI as part of the National Level 
NS/EP Telecommunications Program. 


Final Report of the CSS Task Force, Appendix B, Operational 
Subgroup Report, December 1989. 


Final Report of the CSS Task Force, Appendix C, International 
Subgroup Report, December 1989. 


The CSI Program Office reviewed the CSS Task Force 

Phase II recommendations. The CSI Program Office Satellite Task Force Report, March 2004. 

investigated satellite technologies, such as Ku-band, 

and enhanced capabilities, such as connecting to 

local exchange carriers’ switches and providing PSN 

remote access to NS/EP users, as part of the CSI 

architecture development effort. The projected CSI 

Phase II Architecture implementation date was in FY 

96, but due to budget constraints, the CSI program 

was terminated in September 1994. 

During its 2004 review of the National Space Policy, 
the White Flouse incorporated aspects of the STF 
report into the revised policy. In particular, aspects 
concerning ground and space links and potential 
points of failure were included in the revised policy. 

In addition, at the recommendation of the STF, the 
President appointed PanAmSat Floldings, Inc. to the 
NSTAC to represent the commercial satellite industry. 

Reports Issued 

Issue Papers for Commercial Communications Satellite Systems 
Survivability Initiatives, March 21,1983. 

Commercial Satellite Communications Survivability Report, 
prepared by the CSS Task Force Resource Enhancements 
Working Group, May 20,1983. 

Addendum to the Commercial Satellite Communications 
Survivability Report, May 20,1983. 

CSS Status Report, April 15,1984. 

Final Report of the CSS Task Force, December 1989. 

Final Report of the CSS Task Force, Appendix A, Technical 
Subgroup Report, December 1989. 
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Common Channel Signaling 

Investigation Group / Period of Activity 

Common Channel Signaling (CCS) Task Force 

April 28,1993-January 31,1994 

NS/EP Panel 

March 1994 - March 1995 


Issue Background 

At the April 28, 1993, lES Meeting, the Operations 
Working Group NS/EP Panei recommended that the 
iES establish a task force to investigate common 
channel signaling. The task force would determine 
whether widespread, long- duration CCS outages 
affecting multiple interconnected carriers were a 
significant risk to the public switched network and 
NS/EP telecommunications. The IES established the 
CCS Task Eorce to: 

► Determine if there were failure mechanisms 
that could potentially lead to widespread, 
long-duration CCS outages among multiple 
interconnected carriers; 

► Evaluate the risk to NS/EP user telecommunications; 

► If significant risk existed, examine procedural or 
technological alternatives for mitigating it; and 

► Present appropriate recommendations to 
NSTACXVI. 

The CCS Task Force received informational briefings 
on the CCS architecture and on CCS network security 
incidents and concerns, protocol changes, the role 
of the Network Security Information Exchange in 
evaluating and determining CCS failures, and the 
Network Reliability Council's Signaling Network 
System Focus Team. At NSTAC XVI, March 2, 1994, 
the IES deactivated the task force. 
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At the March 2, 1995, IES Meeting, the NS/EP Group 
Chair explained that during the preceding year, no 
significant outages had occurred during the group’s 
monitoring of the CCS network (the panel’s name 
was changed to the NS/EP Group in accordance 
with the December 1994 IES Guidelines). The Chair 
concluded that if no significant outages occurred 
in the next quarter, the group would discontinue 
monitoring the CCS network. 

History of NSTAC Actions and Recommendations 

The task force reported its conclusions and 
recommendations to NSTAC XVI on March 2, 1994. 
The task force concluded that the CCS architecture 
was inherently reliable and that the probability of 
a large-scale, long-duration, multiple carrier CCS 
outage resulting from a failure condition propagated 
to other CCS networks presented a low risk to NS/EP 
telecommunications. The IES recommended to 
deactivate the task force and tasked the NS/EP 
Panel to monitor CCS reliability for a year before 
reactivating or disbanding the task force. 

After receiving this tasking, the NS/EP Panel developed 
plans for a February 1995 tabletop CCS restoration 
exercise. In February 1995, the Network Cperations 
Forum conducted the CCS restoration exercise, thus 
fulfilling the obligations of the CSS Task Force charge. 

Report Issued 

Final Report of the Common Channel Signaling Task Force, 
January 31,1994. 
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Electromagnetic Pulse 

Investigation Group / Period of Activity 

Electromagnetic Pulse (EMP) Task Force 

September 27,1983 - October 9,1985 

Issue Background 

The NSTAC Industry Executive Subcommittee initiated 
the EMP assessment on September 27, 1983, in 
response to a Government request for industry’s 
perspective on the options available to industry and 
Government for improving the EMP survivability of the 
Nation’s telecommunications networks. The NSTAC 
approved the EMP study on April 3, 1984. 

History of NSTAC Actions and Recommendations 

On December 12, 1984, the NSTAC forwarded the 
following recommendations on EMP to the President: 

► Designate an appropriate Eederal agency to serve 
as an industry point of contact for EMP mitigation 
efforts and information distribution; 

► Support industry through its standards 
organizations in the development of 
electromagnetic standards that take the EMP 
environment into account; and 

► Undertake a program to improve the EMP 
endurability of the Nation’s commercial electrical 
power systems. 

On October 9, 1985, the NSTAC approved the EMP 
Final Task Force Report and forwarded a recommendation 
to the President, calling for a joint industry and 
Government program to reduce the costs of existing 
techniques for mitigating high-altitude electromagnetic 
pulse-induced transients and to develop new 
techniques for limiting transient effects. 
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Actions Resulting from NSTAC Recommendations 

The TSS Task Eorce reviewed the Government 
actions taken on the NSTAC’s EMP 
recommendations. It found that the Government 
had implemented nine of the EMP Initiatives or was 
Implementing them. The TSS Task Eorce made the 
following recommendations: 

► Industry and Government should continue to work 
together to implement the EMP initiatives; 

► The Government should prepare an unclassified 
EMP handbook; and 

► Industry, consistent with cost, should incorporate 
low-cost mitigation practices in its new/upgrade 
programs. 

The NSTAC approved the TSS Task Eorce’s findings 
and recommendations on EMP and forwarded them 
to the President on November 6, 1987. 

The OMNCS designated its Office of Technology 
and Standards as the Eederal office to serve as 
an industry and Government point of contact. It 
used the American National Standards Institute 
TlYl Committee as a forum for developing 
electromagnetic standards in support of industry and 
issued an unclassified EMP handbook {EMPMitigation 
Program Approach, NCS-TiB 87-17). The OMNCS received 
results from a simulated EMP test on an AT&T PSN 
switch. The OMNCS assessed the EMP impact 
on the PSN based on test results of transmission, 
signaling, and switching facilities. EMP test analysis 
results showed little cause for concern regarding the 
physical EMP survivability of the PSN, but revealed 
an increasing PSN vulnerability to 
EMP-induced switch and signaling upset. 

Reports Issued 

EMP Task Force Status Report, January 12,1984. 

EMP Final Task Force Report, July 1985. 
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Energy 

Investigation Group / Period of Activity 

Energy Task Force 

August 31,1988 - March 29,1990 
Octobers, 1991-May 27,1993 

NS/EP Panel 

March 8,1994 - October 5,1994 

Issue Background 

In 1986, the Telecommunications Systems Survivabiiity 
(TSS) Task Force initialiy reviewed the vulnerability of 
telecommunications to the ioss of commerciai electric 
power and presented the resuits of ifs review at the 
February 8, 1987, NSTAC VIi Meeting. The TSS Task 
Force concluded the telecommunications industry 
would be extremely vulnerable to an extended electric 
power outage. As a result, the NSTAC recommended 
to the President that Government initiate a study to 
identify options for ensuring elecfric power survivabilify 
as if related to telecommunications. The NSTAC also 
offered its services to support the effort. Following the 
President’s reply, the NSTAC formed the Energy Task 
Force and it became the focal point of a joinf elecfric 
power and felecommunications indusfry effort to 
address the question of elecfric power survivability as 
it relates to telecommunications. The Department of 
Energy (DOE), NCS, and fhe North American Electric 
Reliability Council (NERC) participated in the Energy 
Task Eorce. 

The NSTAC lES charged the first Energy Task 
Eorce with developing recommendations to 
mitigate the effects of electric power outages on 
telecommunications. It examined interdependencies 
between electric power and telecommunications 
after a major earthquake. Eurther, at NSTAC X, the 
task force presented the following recommendations: 

► Sponsor further research on the impact of a major 
earthquake on electric power, telecommunications, 
and transportation systems; and 
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► Establish a nationwide process for restoring 
electric power and distributing energy supplies 
during major emergencies. 

The NSTAC approved the Energy Task Force Final Report, 
which recommended that the Government: 

► Develop a program for assigning electric power 
restoration priorities to NS/EP telecommunications 
users and providers to provide the soonest 
possible service restoration; 

► Establish a program for assigning priorities for the 
supply, transport, and delivery of fuels to NS/EP 
telecommunications users and providers; 

► Grant a national security waiver from those 
applicable subparts of the Government’s 
underground storage tank regulation (40 Code 
of Federal Regulations Part 280); 

► Ensure that NS/EP telecommunications users who 
need electric power to operate their customer 
premises equipment have a backup power 
capability that can operate through at least a 
7-day electric power outage; and 

► Fund studies to examine the feasibility of the 
Government’s developing and supplying long- 
lasting, cost-effective backup power sources for 
critical telecommunications facilities. 

In October 1991, the NSTAC reactivated the 
Energy Task Force to advise the NCS and the DOE 
concerning the implementation of energy priorify 
initiatives for telecommunications facilities. The 
reactivated task force assisted in developing the 
DOE’S Telecommunications Electric Service Priority 
(TESP) initiative in response to the original task 
force’s first two recommendations. When fully 
implemented, the TESP initiative would provide 
priority electric power restoration to critical NS/EP 
telecommunications facilities. 

After reviewing DOE’s National Energy Strategy (NES) 
in December 1991, the lES also charged the Energy 
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Task Force to review the NFS from the perspective of 
benefits to NS/EP telecommunications enhancements 
and develop NS/EP telecommunications energy 
concerns/issues for incorporation into DOE’s next 
issue/update of the NES. 

The energy issue concluded when NSTAC XV 
charged the lES to deactivate the Energy Task Force. 
The NSTAC also tasked the lES to request progress 
reports from the Government on the status of its 
recommendations. 

History of NSTAC Actions and Recommendations 

As a result of an NSTAC VIII recommendation, 
the lES formed the first Energy Task Force. The 
task force was the focal point of an electric 
power/telecommunications industry etfort to address 
the issue of electric power survivability as it relates to 
telecommunications. The DOE, NCS, and the NERC 
actively participated in the Energy Task Force. 

On October 3, 1991, NSTAC XIII approved the 
recommendation to establish a tollow-on Energy 
Task Force. The task force's charge was to support 
the OMNCS in its efforts with DOE to develop criteria 
and a process for identifying critical industry NS/EP 
telecommunications facilities that qualify for electric 
power restoration and priority fuel distribution. 

At the May 27, 1993, NSTAC XV Meeting, members 
approved the Energy Task Force Final Report and the task 
force’s recommendations, and forwarded both to 
the President. The task force recommended that 
the Government: 

► Continue to support the operation, administration, 
and management of DOE’s TESP initiative; 

► Assign Federal responsibility for the establishment 
of a program to ensure priority availability of fuel 
supplies for telecommunications companies 
during emergencies; 

► Encourage the Nation’s electric utilities to 
coordinate with telecommunications companies 
to provide safe access to disaster areas requiring 
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Telecommunications Service Priority provisioning 
or restoration; 

► Encourage State and local Governments 
to modify their emergency plans to allow 
telecommunications, electric utility, and fuel 
supply company’s access into areas experiencing 
outages; and 

► Modify the Federal Response Plan and the 
National Plan for Telecommunications Support In 
Nonwartime Emergencies to include TESP and 
to address emergency fuel resupply, access, and 
safety issues. 

The Energy Task Force also recommended that, 
to address the improvement of electric power 
survivability under disaster conditions, the 
President’s National Energy Strategy should: 

► Increase R&D and incentives to reduce 
transmission and distribution vulnerabilities; 

► Evaluate locating dispersed power generation 
closer to customer loads as a possible means of 
further reducing transmission and distribution 
vulnerabilities; and 

► Eocus more R&D on alternative backup power 
technologies for the telecommunications industry 
by encouraging cooperative R&D agreements 
between the U.S. national laboratories and 
interested telecommunications companies. 

On March 8, 1994, the NS/EP Panel discussed 
power outages that occurred during the recent winter 
storms on the East Coast and during the Northridge 
earthquake, and their effect on telecommunications. 
The panel agreed that a call from the power 
companies would have alerted carriers to the 
impending rolling blackouts and the need to switch 
to an emergency backup power source. Additionally, 
the panel agreed that the TESP initiative should be 
more responsive to industry’s requirements during 
emergencies and disasters. As a consequence of this 
discussion, the panel scheduled briefings from the 
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NCS Office of Plans and Programs on the status of ifs 
discussions with DOE on TESP, and then with DOE 
on the status of the TESP initiative. 

On October 13, 1994, as a result of industry’s 
concerns about the initiative, the NSTAC invited the 
DOE to address the joint Operations Working Group 
(OWG) and Plans Working Group (PWG) meeting. The 
former TESP initiative was introduced as the National 
Electric Service Priority (ESP) Program in Support of 
Telecommunications. ESP was defined as a program 
developed jointly between DOE, the NCS, and the 
telecommunications industry. Under ESP, electric 
utilities voluntarily add NS/EP telecommunications 
facilities to their ESP programs. The ESP program 
emphasizes local coordination between electric 
utilities and telecommunications facilities. 

In response to criticism that the DOE was not 
responsive to industry’s needs during the 1994 
winter storms, the DOE representative noted several 
problems contributed to the insufficient generating 
capacity. Utilities had been asked to switch from 
natural gas; barges were unable to get through ice to 
deliver coal; northeastern electric power companies 
were purchasing power from California, Elorida, and 
Oklahoma. Plowever, the rising demand resulted in 
brownouts, followed by rolling blackouts. 

In December 1994, the NCS provided an updated 
list of critical telecommunications facilities to DOE. 
The DOE collected electric utility points-of-contact 
information that the telecommunications industry 
supplied. DOE continues to work with all 50 States to 
ensure nationwide ESP implementation. 

In regard to other telecommunications energy issues, 
DOE recommended industry contact each State and 
that the State enroll In the fuel set-aside program. 
DOE further stated that, as a result of Hurricane 
Andrew that hit Elorida, power companies and 
telecommunications providers were working more 
closely together. Elnally, In response to industry’s 
request to obtain access to a disaster site, DOE 
stressed that such access could be dangerous. 
Criminal elements can harm utility workers unless 
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there is sufficient law enforcement personnel 
available to ensure their protection. 

Actions Resulting from NSTAC Recommendations 

In response to the Energy Task Force recommendations 
at NSTAC X, the OWG NS/EP Panel discussed 
the status of NCS and DOE activities. The panel 
expressed support for recent NCS and DOE initiatives 
and concluded that industry should continue to 
advise the NCS and DOE on implementation of the 
energy initiatives. The lES and NSTAC approved the 
recommendation to establish a follow-on Energy Task 
Force. Its charge was to support the OMNCS efforts 
with DOE and NCS to develop criteria and a process for 
Identifying critical Industry NS/EP telecommunications 
facilities that quality for electric power restoration and 
priority fuel distribution. 

On April 2, 1991, the NCS issued Directive 3- 
8, Provisioning of Emergency Power in Support 
of NS/EP Telecommunications. The DOE and 
the NCS worked together to identify critical 
telecommunications facilities that qualify for priority 
electric power restoration. 

In December 1993, DOE began implementing the 
TESP initiative and made plans to update the critical 
facility list. As of September 1993, 28 States indicated 
their desire to voluntarily participate in the TESP 
initiative; with additional States expected to follow. 

At the October 13, 1994, OWG-PWG meeting, DOE 
explained that it replaced the TESP Initiative with its 
ESP program in support of telecommunications. DOE 
had developed the ESP program in response to the 
National Security Advisor’s request that the Secretary 
of Energy develop and implement a priority process 
for electric power restoration. DOE is working with all 
50 States In implementing ESP nationwide. DOE’s 
partnership with the NCS and the telecommunications 
industry is facilitating ESP implementation. 

During NSTAC Cycle XXVIII, the NSTAC revisited 
issues related to interdependency between 
the telecommunications and electric power 
infrastructures and formed the Telecommunications 
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and Electric Power Interdependency Task Force 
(TEPITF) to address these issues. (See the 
Interdependency Between Telecommunications and 
Electric Power Infrastructures section in the Active 
Issues section of this NSTAC Issue Review). 


Reports Issued 

Report on Earthquake Hazards, June 8,1989. 

Energy Task Eorce Einal Report, February 1990. 

Energy Task Eorce Einal Report: Telecommunications Electric 
Service Priority and National Energy Strategy Review, April 1993. 
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Enhanced Call Completion 

Investigation Group / Period of Activity 

Industry Executive Subcommittee (lES) Funding and 
Regulatory Working Group (FRWG) 

(Assured access) 

June 7, 1990 - September 1990 

(Regulatory aspect of call-by-call preferential treatment) 

July-December 1993 

Enhanced Call Completion (ECC) Task Force 

December 13,1990-July 17,1992 

ECC Ad Hoc Group 

July 17,1992-August 2, 1993 

Issue Background 

Following its reactivation after NSTAC XI, the NSTAC 
lES tasked the FRWG to investigate NS/EP issues 
affecting assured access to the public switched 
network (PSN). During FRWG discussions with the 
Government, the group agreed that assured access 
was only one component of the Government’s 
need for enhanced NS/EP call completion. The 
group defined assured access as priorify access to, 
transportation through, and egress from the PSN 
for NS/EP users when portions of fhe PSN were 
either physically isolated or too congested to permit 
unhindered access and call completion. 

The FRWG prepared a study addressing the 
regulatory and technical components of assured 
access. The study reported that at its initial meeting, 
the FRWG concluded that the Government required 
enhanced call completion for NS/EP traffic. The 
FRWG members agreed, however, thaf fhey must 
further define the technical features of the issue 
before identifying regulatory issues. 

On Augusf 22, 1990, the FRWG recommended that 
it establish an ECC Task Force to determine how 
existing and evolving technologies could best be 
exploited to enhance the priority access, transport. 
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and egress of NS/EP traffic. The ERWG’s sfudy 
also stated that the proposed task force should 
evaluate the Intelligent Networks Task Force Final Report and 
recommendations, and coordinate its efforts with 
those of the OMNCS to avoid duplication. 

Eollowing the ERWG’s investigation of issues affecting 
assured access to the PSN by NS/EP callers and 
its subsequent recommendations, the NSTAC, 
at its December 13, 1990, meeting charged the 
lES to establish a task force to review the issue of 
enhancing call complefion for NS/EP users during 
periods of congesfion. Specifically, fhe lES directed 
the task force to identify technical approaches and to 
recommend a plan of action for obtaining enhanced 
call completion in both the near and long term. 

The ECC Task Eorce studied existing and evolving 
technologies that would provide the NS/EP user PSN 
access and call completion without interruption, 
with minimum delay, and on a preferential basis 
during network damage or congestion. During its 
18-month investigation, the task force identified 26 
currenf or planned enhanced call complefion features 
and defined their NS/EP application, availability, 
and acquisition procedures. The task force also 
determined the importance of the Fligh Probability of 
Call Complefion (FIPC) standard in implementing an 
NS/EP call identifier to provide call-by-call preferential 
treatment and to enhance existing PSN features. 

At the July 17, 1992, NSTAC XIV Meeting, members 
approved the ECC Task Force’s report for forwarding 
to the President, the two proposed recommendations 
to the President, and the proposed NSTAC XIV 
charges to the lES. In response to these charges, the 
lES deactivated the ECC Task Force and established 
an ad hoc group to work with the Government to: 

► Advocate and support approval of the FIPC 
standard, investigate potential ECC regulatory 
issues with the ERWG and implement ECC 
network capabilities. 

At the August 2, 1993, lES Meeting, members 
approved the deactivation of the ECC Ad Floe 
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Group, which had completed its work. The group 
served as a forum for issues such as ceiiular priority 
access, preferentiai access for North Atlantic Treaty 
Organization countries, and future broadband 
services, it assisted the Government in its effort to 
obtain approvai of the HPC standard—pubiished 
as American National Standards Institute T1.631 in 
August 1993. The group also worked closely with the 
Government to develop EGG features demonstration 
scenarios. It met with the GETS integrator and 
Government contractors to discuss demonstration 
plans and scenarios. 

As part of its charge to inform the Government about 
EGG services affecting the National Level NS/EP 
Telecommunications Program initiatives, the group 
assisted the Government in developing educational 
materials such as the ECC Services Cost/Benefit Analysis 
Report, and the 1993 National Communications System 
(NCS) Member Agency Telecommunications Enhancement 
Handbook. The group worked with the Government 
in addressing potential regulatory impediments to 
implementing enhanced call completion services. 

It framed and defined significant elements in the 
call-by-call preferential treatment issue before 
forwarding the issue to the ERWG for its action. 

In July 1993, the ERWG responded to an April 
14, 1993, memorandum to the NCS Executive 
Agent directing the NCS to work with the ERWG to 
investigate potential regulatory issues arising from 
the implementation of enhanced call completion 
attributes for NS/EP activities. The ERWG explored 
whether the prohibition of undue preferences in 
Section 202(a) of the Communications Act of 1934, 
as amended, required a specific ECC regulation 
authorizing the provision of priority calling features to 
NS/EP users of the PSN. 

The ERWG determined ECC approval of preferenfial 
treatment would benefit both industry and 
Government. Eollowing lES approval, the OMNCS 
forwarded a letter to the ECC requesting that the 
Commission issue an opinion regarding whether 
common carriers may provide call-by-call priority 
service for connecting emergency calls over the public 


switched network. The ECC responded by issuing a 
Public Notice on January 7, 1994, which requested 
that public comments be filed with the Commission by 
February 15, 1994, and that reply comments be filed 
by March 1, 1994. The OMNCS filed reply comments 
with the ECC on March 1, 1994, requesting that the 
Commission issue a favorable opinion. 

On August 30, 1995, the ECC responded to the 
OMNCS regarding the call-by-call priority issue. 

In its letter, the ECC stated that the request for 
declaratory ruling filed on November 29, 1993, 
was moot because lawful tariffs implementing the 
federally managed GETS program had gone into 
effect. Call-by-call priority is a feature of the GETS 
program. Therefore, the ECC dismissed the petition 
for declaratory ruling without prejudice. 

History of NSTAC Actions and Recommendations 

On December 13, 1990, NSTAC XII charged the lES 
to establish the ECC Task Force as a result of the 
FRWG’s investigation of assured access issues. 

On July 17, 1992, NSTAC members approved the 
ECC Task Force’s report for forwarding two proposed 
recommendations to the President: 

► The Government should take the following sfeps 
to enhance call completion for NS/EP users: 

• Take advantage of exisfing and emerging 
services, features, and capabilities in the PSN 

• Continue to support the near-term adoption of 
the HPC standard by the Exchange Carriers 
Standards Association T1 Committee 

• Investigate the NS/EP advantages of a calling 
name delivery service 

• Work with NSTAC’s ERWG to investigate 
potential regulatory issues 

• Sponsor industry ECC forums to further define 
ECC and resolve implementation issues. 
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► The Government should use the ECC Task 
Force report as a reference for modifying or 
implementing current or future services and 
technologies. In response to NSTAC XIV charges, 
the lES established the ECC Ad Hoc Group. On 
August 2, 1993, lES members deactivated the 
ECC Ad Hoc Group. 

Actions Resulting from NSTAC Recommendations 

In response to an NSTAC XIV recommendation 
from the ECC Task Force, the White House issued a 
memorandum to the NCS Executive Agent on April 
14, 1993, directing the NCS to work with the FRWG to 
investigate potential regulatory issues arising from the 
implementation of ECC attribufes for NS/EP activities. 
The FRWG sought to clarify whether prohibitions of 
undue preferences in the Communications Act of 1934 
required a specific ECC regulation to authorize the 
provision of priority calling features to NS/EP users of 
the public switched network. The ECC resolved the 
issue on August 30, 1995, when the ECC informed 
the OMNCS of its decision regarding the call-by-call 
priority issue. 


Reports Issued 

Assured Access Issue Paper, October 13,1989. 

Report on the FRWG Review of Assured Access, November 7,1990. 

Finat Report of the Enhanced Cati Comptetion (ECC) Task Eorce, 
July 1992. 

Einai Report of the Enhanced Cait Comptetion (ECC) 

Ad Hoc Group, December 1993. 
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Financial Services 

Investigation Group / Period of Activity 

Financial Services Task Force (FSTF) 

March 2003-April 2004 

Issue Background 

In November 2002, the Federal Reserve Board 
(FRB) and BITS—a nonprofit industry consortium 
of the 100 largest financial institutions in the United 
States that focuses on issues related to security, 
crisis management, e-commerce, payments, and 
emerging technologies—briefed the lES of the 
NSTAC on the significant dependence of the financial 
services (FS) sector on the telecommunications 
infrastructure to support core payment, 
clearance, and settlement processes of financial 
institutions. Given that dependence, disruption of 
telecommunications services could hamper critical 
financial services processes, potentially affecting 
the national economy. To minimize operational risks 
and ensure the timely delivery of critical financial 
services, the FRB recommended that the NSTAC 
analyze telecommunications infrastructure issues 
pertaining to network redundancy and diversity. 

The NSTAC, therefore, established the FSTF to 
conduct the analysis during NSTAC Cycle XXVII. 

History of NSTAC Actions and Recommendations 

The FSTF emphasized that the concept of resiliency 
and its components of diversity, redundancy, and 
recoverability are critical to understanding some 
of the NS/EP issues currently challenging the FS 
and telecommunications industries. The task force 
acknowledged that it is imperative for the FS sector to 
maintain diversity as a component of resiliency. The 
primary challenges identified by the FSTF with respect 
to diversity were the failure of critical services resulting 
from loss of diversity; the ability to ensure that diversity 
is predictable and continually maintained; and the 
potential for lack of clear understanding of terms 
and conditions in telecommunications contracts or 
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tariffs (and the potential for resulting confusion when 
financial services institutions establish business 
continuity plans). 

The FSTF recognized that without a real-time process 
to guarantee that a circuit’s path or route is static and 
stable, an NS/EP customer cannot be assured at all 
times that the diversity component of the resiliency 
plan will retain its designed characteristics. However, 
the telecommunications infrastructure was designed 
and engineered based on a business model directed 
at the general public. When necessary, networks 
have been modified or developed to meet specific 
needs at the customer level except where limited by 
the available technology or a customer’s willingness 
to purchase unique requirements. 

The FSTF emphasized that all interested parties 
should support research and development activities 
for improving managed network solutions and 
alternative technologies as a potential means for 
achieving high resiliency for the FS customer 
base. Targeted capital incentives should also 
be considered as a tool to encourage critical 
infrastructure owners, including the FS sector, 
to make the necessary investments to mitigate 
telecommunications resiliency risks to their business 
operations. Appropriately structured capital recovery 
incentives for critical business operations could be 
used to accelerate immediate investments to mitigate 
vulnerabilities to critical NS/EP operations. 

The FSTF also noted that when different business 
continuity strategies cannot fully guarantee 
operational sustainability, specifically engineered 
and managed efforts might be required. The degree 
of assurance that a business operation deems 
adequate to achieve a high level of resiliency will 
dictate the decisions and the appropriate approach 
to be pursued. To that end, the task force concluded 
that cross-sector assessments or customer- 
provider assessments would remain useful tools 
to facilitate better understanding of the need for 
resiliency. Indeed, FSTF members acknowledged 
the importance of promoting mutual understanding 
among the FS and telecommunications sectors 


67 


PREVIOUSLY ADDRESSED ISSUES ◄ NSTAC XXIX Issue Review 


to effectively address NS/EP-related issues. Both 
sectors pledged to continue in their efforts to engage 
members of their communities, as well as the public 
sector, in a constructive dialogue to foster mutual 
understanding of their operations and unique 
needs. Furthermore, the framework that the FSTF 
developed to analyze the dependencies of the FS 
sector on the telecommunications industry could be 
adapted to conduct risk assessments of other critical 
infrastructures. 

On the basis of the FSTF report, the NSTAC 
recommended that the President: 

► Support the Alliance for Telecommunications 
Industry Solutions’ (ATIS) National Diversity 
Assurance Initiative and develop a process to: 

• Examine diversity assurance capabilities, 
requirements, and best practices for critical 
NS/EP customers and, where needed 

• Promote research and development to 
increase resiliency, circuit diversity, and 
alternative transport mechanisms. 

► Support financial services sector initiatives 
examining: 

• The development of a feasible “circuit-by- 
circuit” solution to ensure telecommunications 
services resiliency 

• The benefits and complexities of aggregating 
sectorwide NS/EP telecommunications 
requirements into a common framework to 
protect national economic security. 

► Coordinate and support relevant cross-sector 
activities {e.g., standards development, research 
and development, pilot initiatives, and exercises) in 
accordance with guidance provided in Homeland 
Security Presidential Directive 7 (HSPD-7). 
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► Provide statutory protection to remove liability 
and antitrust barriers to collaborative efforts when 
needed in the interest of national security. 

► Continue to promote the Telecommunications 
Service Priority program as a component of the 
business resumption plans of financial services 
institutions. 

► Promote research and development efforts 
to increase the resiliency and the reliability of 
alternative transport technologies. 

► Examine and develop capital investment recovery 
incentives for critical infrastructure owners, 
operators, and users that invest in resiliency 
mechanisms to support their most critical NS/EP 
telecommunications functions. 

Actions Resulting from NSTAC Recommendations 

In response to the FSTF report, ATIS agreed to work 
with the FRB on an in-depth assessment of diversity 
assurance. A final report on the assessment was 
completed in February 2006. Representatives from 
ATIS also visited the lES to brief them on the findings 
and recommendations discussed in the assessment. 


Report Issued 

Financial Services Task Force Report, April 2004. 
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Funding of NSTAC Initiatives 

Investigation Group / Period of Activity 

Funding of NSTAC Initiatives (FNI) Task Force 

April 3,1984 - December 12,1984 


Issue Background 

On April 3, 1984, the NSTAC agreed to address 
the funding of NSTAC initiatives issue to determine 
the costs and benefits associated with its 
recommendations to the Government. The purpose 
of FNI was to guide and prioritize NSTAC actions. In 
August 1984, the FRWG established the FNI Task 
Force to investigate approaches to NSTAC funding 
mechanisms. 

History of NSTAC Actions and Recommendations 

On December 12, 1984, the NSTAC approved the 
funding methodology developed by the FNI Task 
Force and instructed the IBS to: 

► Adopt the methodology developed by the FNI 
Task Force; 

► Issue the funding methodology as guidance to all 
existing and future task forces; and 

► Direct all task forces to determine costs, benefits, 
and applicable funding mechanisms for each 
recommended initiative. 

The NSTAC instructed all NSTAC task forces 
and working groups to apply the FNI funding 
methodology to the recommendations they 
developed. The FRWG assists all active and future 
NSTAC task forces, when necessary, in providing 
cost/benefit estimates and proposed funding 
mechanisms for all recommended initiatives using 
the guidelines from the funding report. 
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Actions Resulting from NSTAC Recommendations 

The FRWG (reconvened March 1990) reviewed the 
NSTAC funding methodology and worked with the 
Enhanced Call Completion Task Force to develop 
an order-of-magnitude cost model for use by all 
task forces. 


Report Issued 

NSTAC Funding Methodology, October 25,1984. 
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Globalization 

Investigation Group / Period of Activity 

National Information Infrastructure (Nil) Task Force 

August 2,1993-March 18,1997 

Operations Support Group (OSG) 

April 22,1997-September 23,1999 

Information Infrastructure Group (MG) 

April 22,1997-September 23,1999 

Globalization Task Force (GTF) 

September 23,1999 - May 16,2000 

Issue Background 

In 1993, the NSTAC established an Nil Task Force 
and charged It with examining the implications 
of the evolving U.S. information infrastructure 
for NS/EP communications. The Nil Task Force 
observed that the Nil’s connectivity to the emerging 
Global Information Infrastructure (Gil) potentially 
presented both opportunities and risks for NS/EP 
communications. In its March 1997 report to 
NSTAC XIX, the Nil Task Force concluded that 
the pervasive and rapidly evolving nature of the 
Gil necessitated a continuing effort by NSTAC 
task forces and working groups to track the Gil’s 
implications for NS/EP communications. 

As a result, the NSTAC lES tasked the OSG 
in April 1997 to monitor the U.S. information 
infrastructure’s global interfaces, because of the 
potential for increased vulnerabilities adversely 
affecting the national interest. Specifically, the 
OSG gathered information on the International 
Telecommunication Union’s Global Mobile Personal 
Communications by Satellite Memorandum of Understanding. 

In October 1998, the lES tasked the IIG to conduct 
a forward-looking analysis of the Gil and associated 
NS/EP opportunities and challenges. 
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During a reorganization of the lES and its working 
group structure in September 1999, the lES 
formed the GTF to continue to address the 
Gil issue. Specifically, the lES tasked the GTF 
with developing a “picture” of the Gll in 2010, 
identifying NS/EP issues. The GTF was also given 
two additional tasks that were global in scope: 
assessing the security implications of foreign 
ownership of telecommunications networks and 
examining export policies dealing with the transfer 
of strong encryption products, satellite technology, 
and high-performance computers. 

During the NSTAC XXII and XXIII cycles, the IIG 
and GTF researched and gathered information 
from industry and Government experts on emerging 
space-, airborne-, and land-based communications 
systems and services. These information gathering 
activities provided the GTF with the insights needed 
to characterize the Gll in 2010 and draw conclusions 
about NS/EP telecommunications preparedness. 

Drawing on these insights, the GTF was able to 
describe what physical network elements, services, 
and protocols might be prominently featured 
in 2010, paying specific attention to the global 
homogenization of communications capabilities, 
expected improvements to quality of service and 
network assurance, and the ubiquity and availability 
of advanced communications technologies as 
pertaining specifically to NS/EP users. The GTF 
documented its analysis in its May 2000 report to 
NSTAC XXIII. Based on that analysis, the NSTAC 
recommended that the President direct appropriate 
departments and agencies to: 

► Conduct exercises in those areas and 

environments in which NS/EP operations can be 
expected to take place to ensure that the required 
high-capacity, broadband access to the Gll is 
available; and 
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► Ensure that NS/EP requirements, such as 
interoperability, security, and mobility, are 
identified and considered in standards and 
technicai specifications as the Gil evolves to 2010 
and identify any specialized services that must 

be developed to satisfy NS/EP requirements not 
satisfied by commercial systems. 

In addition, the LRWG assisted the GTE in assessing 
the security implications of foreign ownership of 
telecommunications networks. The LRWG examined 
domestic regulatory history and conducted analyses 
of several mergers and acquisitions between 
domestic and foreign telecommunications carriers. 
Through the case studies, the group found that 
the current regulatory structure satisfied the 
different interests of the parties involved. The LRWG 
concluded that it was unclear whether further 
statutory or regulatory changes would effectively 
enhance the role of national security issues in 
foreign ownership situations at this time. The GTE 
May 2000 report to NSTAC XXIII includes the LRWG 
analysis of the issue. 

Based on the GTE’s report, the NSTAC 
recommended that the President: 

► Ensure that the review process for commercial 
arrangements involving foreign ownership remains 
adequate to protect NS/EP concerns as the 
environment evolves and becomes more complex. 

Lastly, addressing technology export, the GTE 
compiled some basic information on the key 
technology export issue areas. Given that technology 
progresses faster than export policy can keep up with 
it, the GTE recommended continued monitoring of 
developing export policies and regulations. The GTE 
also investigated guidelines to assist companies in 
understanding Government approval of technology 
sales. The GTE completed its tasking to scope the 
issue of technology export, concurring with the 
Government’s efforts to periodically reevaluate the 
limits placed on the export of technologies. 


Reports Issued 

National Information Infrastructure Task Force Report, 
March 1997. 

Operations Support Group Report, September 1998. 

Information Infrastructure Group Report, June 1999. 

Globalization Task Force Report, May 2000. 

Global Infrastructure Report, May 2000. 

Paper on Foreign Ownership: Telecommunications and 
NS/EP Implications, May 2000. 
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Industry/Government Information 
Sharing and Response 

Investigation Group / Period of Activity 

National Coordinating Center for Telecommunications 
(NCC) Vision Task Force 

October 15,1996-April 22,1997 

Operations Support Group (OSG) 

April 22,1997-September 23,1999 

Information Sharing/Critical Infrastructure Protection 
(IS/CIPTF)Task Force 

September 23,1999 - May 16,2000 

Issue Background 

The NSTAC formed the National Coordinating 
Mechanism (NCM) Task Force in December 1982 
to facilitate industry/Government response to the 
Government’s growing NS/EP telecommunications 
service requirements in the post-divestiture 
environment. The task force submitted its final 
report, the NCM Implementation Plan, to the NSTAC 
on January 30, 1984. That report led to formation 
of the NCC, an emergency response coordination 
center that supports the Government’s NS/EP 
telecommunications requirements. 

Since 1984, threats to the NS/EP 
telecommunications infrastructure changed 
significantly. In response, the NSTAC lES established 
the NCC Vision Task Force in October 1996 to 
consider the implications of the new environment 
for the functions performed by the NCC. The lES 
charged the task force to determine whether the 
mission, organization, and capabilities of the NCC 
were still valid, considering the ongoing changes 
in technology, industry composition, threats, and 
requirements. Following the lES group reorganization 
in April 1997, the task force became the NCC Vision 
Subgroup and later the NCC Vision-Operations 
Subgroup under the OSG. 
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In 1997, the NSTAC also revisited the original 
concept for an industry/Government mechanism 
to coordinate planning, information sharing, and 
resources in response to NS/EP requirements. 
Unlike the original NCM plan that applied to the 
telecommunications infrastructure, this revised 
NCM concept involved linking all the Nation’s 
critical infrastructures {e.g., telecommunications, 
financial services, electric power, and 
transportation). In July 1997, the OSG created 
the NCM Subgroup to explore the need for and 
feasibility of an NCM across Infrastructures. 

In May 1998, the President released PDD-63, a 
critical infrastructure protection directive calling for, 
among other things, industry participation in the 
Government’s efforts to ensure the security of the 
Nation’s infrastructures. As it continued to refine the 
NCM concept, the NCM Subgroup considered this 
Government initiative. 

In September 1998, the OSG formed the Year 2000 
(Y2K) Subgroup to address several Y2K Issues 
raised at the NSTAC XXI meeting, including the need 
for Y2K oufreach efforts, the need to emphasize 
contingency planning and restoration scenarios, the 
potential for public overreaction to the Y2K problem, 
and the lack of a global approach to handle Y2K 
problems that were international In scope. The effort 
was a continuation of earlier efforts by the NCC 
Vision-Operations Subgroup, which began a study 
of the NCC’s operational readiness and coordination 
capabilities for potential public network disruptions 
caused by the Y2K problem. 

Following NSTAC XXII the lES tasked the OSG 
to examine potential lessons learned from Y2K 
experiences fhat could be applied to critical 
infrastructure protection efforts. The OSG focused 
on the experiences of the NCC to determine how its 
operations during the Y2K rollover period translated 
Into functions to be performed as ISAC (in accordance 
with PDD-63). In addition the OSG continued to 
monitor enhancements to the NCC that ensured an 
electronic Indications, Assessment, and Warnings 
(lAW) capability to support the ISAC function. 
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In September 1999 following a reevaluation 
of NSTAC working groups, the lES created the 
IS/CIPTF to examine mechanisms and processes 
for profected, operafional information sharing 
that would help achieve the goals of PDD-63 
and further the role of fhe NCC as an ISAC for 
telecommunications. In addition, the lES directed 
the IS/CIPTF to continue, through outreach efforts, 
interaction with Government leaders responsible for 
PDD-63 implementation. 

History of NSTAC Actions and Recommendations 

During 1997, the NCC Vision Subgroup worked 
closely with the NCS member organizations and 
NCC industry representatives to develop a common 
framework for assessing the NCC’s ongoing role. 
The subgroup validated the original 10 NCC 
chartered functions and updated the NCC Operating 
Guidelines (both written in 1984) for fhe current 
operational environment. The subgroup also 
determined that an electronic intrusion incident 
information processing function could be integrated 
into the NCC’s activities. In August 1997, the 
subgroup held an industry/Government tabletop 
exercise to test the draft concept of operations for 
NCC intrusion incident information processing. 

The OSG documented the subgroup’s activities 
and accomplishments in the OSG’s report to the 
December 11, 1997, NSTAC XX Meeting. 

The NSTAC approved the OSG’s NSTAC XX report 
and recommended that the President: 

► Establish a mechanism within the Federal 
Government with which the NCC can coordinate 
intrusion incident information issues and 
with which NSTAC groups can coordinate the 
development of standardized reporting criteria. 

The NSTAC also endorsed NCC implementation of 
an initial intrusion incident information processing 
pilot based on voluntary reporting by industry and 
Government. 

In 1998, the NCC modified its standard operating 
procedures to accommodate an electronic intrusion 


incident information processing capability. With 
the OSG’s support and assistance, the NCC began 
its intrusion incident information processing pilot 
on June 15, 1998. The NCC Vision-Operations 
Subgroup worked closely with the OMNCS and 
the Manager, NCC, as the NCC implemented 
the intrusion incident processing pilot, which it 
completed in October 1998. In addition, the NCC 
Vision-Operations Subgroup developed a paper, 
the NCC Intrusion Incident Reporting Criteria and Format 
Guidelines, to establish standardized reporting criteria 
and to outline steps in NCC electronic intrusion 
report collection, processing, and distribution. The 
OSG report to NSTAC XXI includes the paper. 

Leading up to NSTAC XX, the NCM Subgroup met 
jointly with the Information Infrastructure Group’s lA 
Policy Subgroup and produced a joint report. The 
report concluded that the revised NCM concept 
provided the framework for fhe Federal Government 
and the private sector to address solutions to 
infrastructure protection concerns. The OSG 
included the joint report in its full NSTAC XX reporf, 
which the NSTAC approved. Specifically, fhe NSTAC 
recommended thaf fhe President: 

► Direct the appropriate departments and agencies 
to work with the NCS and NSTAC in further 
investigating the NCM concept. 

Subsequently, lES representatives presented 
the revised NCM concept to senior Government 
officials to aid the Administration’s efforts to 
establish national policy on the protection of 
critical national infrastructures. 

Throughout the NSTAC XXI cycle, the OSG 
considered the infrastructure protection efforts of 
fhe Federal Government in conjunction with the 
enhanced role of the NCC. lES and NCM Subgroup 
members met with members of fhe National 
Infrastructure Protection Center (NIPC) to address 
the role of industry in the Government’s new lA 
environment. The Government created the NIPC in 
February 1998 as a national critical infrastructure 
threat assessment, warning, vulnerability, law 
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enforcement investigation, and response entity. The 
NI PC’s mission is to detect, deter, assess, warn of, 
respond to, and investigate computer intrusions and 
unlawful acts, both physical and cyber, that threaten 
or target the Nation’s critical Infrastructures. As a 
result of these meetings, the NCC and NIPC began 
to develop processes to detail the flow of information 
between the two entities. 

At the end of the NSTAC XXI cycle, the OSG 
concluded that the NCC provided a model for 
all infrastructures by which information could be 
gathered, analyzed, sanitized, and provided to 
the Government. In addition, regarding PDD-63 
implementation, the OSG concluded that more than 
one Individual or entity would be needed to serve 
as the sector coordinator to represent the highly 
diverse information and communications sector. 

The NSTAC approved the OSG’s September 1998 
report to NSTAC XXI and recommended that the 
President direct the lead departments and agencies 
as designated In PDD-63 to: 

► Consider adapting the NCC model as appropriate 
for the various critical infrastructures to provide 
warning and information centers for reporting and 
exchange of information with the NIPC through 
the NCM process; and 

► Establish an industry/Government coordinating 
activity to advise in the selection of a sector 
coordinator and provide continuing advice to 
effectively represent each critical infrastructure. 

Following NSTAC XXI, the OSG’s NCC Vision-Operations 
Subgroup worked closely with the OMNCS and the 
Manager, NCC, as the NCC continued Its electronic 
intrusion incident processing function. The subgroup 
continued to assist the NCC in evaluating any needed 
revisions to the lAW reporting criteria and format 
guidelines. 

The OSG’s NCC Vision-Operations Subgroup also 
assessed whether the NCC requires additional 
industry and Government participation within the 
NCC to widen the scope of expertise and operational 
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personnel available to fulfill the lAW mission. During 
the NSTAC XXII cycle, the subgroup developed a 
list of companies and Government departments 
and agencies for the Manager, NCS, to consider as 
candidates for participation in the NCC. 

PDD-63 established the concept of an ISAC that 
would be a private sector entity responsible for 
gathering, analyzing, sanitizing, and disseminating 
to industry private sector information related to 
vulnerabilities, threats, intrusions, and anomalies 
affecting the critical infrastructures. At the end of the 
NSTAC XXII cycle, the OSG concluded that the NCC 
already performed the primary functions of an ISAC 
for the telecommunications sector and that industry 
and Government should establish it as such. 

The OSG’s Y2K Subgroup investigated domestic and 
international Y2K preparedness and contingency 
planning efforts for the telecommunications 
infrastructure. The subgroup held a number 
of informational meetings with Government 
representatives to address ongoing Y2K readiness 
and contingency planning efforts. To understand 
public concerns about the Y2K problem, the 
Y2K Subgroup also Investigated the Initiatives 
of grassroots Y2K community forums and those 
groups promulgating “doomsday” scenarios. The 
subgroup’s findings are included In the OSG’s 
June 1999 NSTAC XXII report. 

Based on that report, the NSTAC recommended that 
the President: 

► Direct the President’s Council on Y2K Conversion 
and the Federal Government continue providing 
timely, meaningful, and accurate Y2K readiness 
and contingency planning information related 
to the information and communications critical 
infrastructures to State and local governments, 
thereby enhancing the flow of information to the 
general public and community Y2K groups. 

Actions Resulting from NSTAC Recommendations 

The NSTAC’s support for the evolving role of the 
NCC helped pave the way for the establishment 
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of the NCC as an ISAC for telecommunications 
under the provisions of PDD-63. During 1997, the 
NSTAC advocated and later endorsed the NCC’s 
implementation of an electronic intrusion incident 
reporting capability based on voiuntary reporting 
by industry and Government, in January 2000, the 
Nationai Security Council agreed with the NSTAC’s 
1999 conclusion that the NCC was performing the 
primary functions of an ISAC. In March 2000, the 
NCC formally achieved initial operating capability as 
an ISAC for the telecommunications sector. 

Following the October 21, 2004, Principals 
Conference Call, the NSTAC formed the National 
Coordinating Center Task Force (NCCTF) to examine 
the future mission and role of the NCC. Please see 
the NCCTF section in the Active Issues section of this 
NSTAC Issue Review further information. 


Reports Issued 

Operations Support Group Report, December 1997. 

Information Assurance: A Joint Report of the lA Poticy Subgroup 
of the Information Infrastructure Group and the NCM Subgroup 
of the Operations Support Group, December 1997. 

Operations Support Group Report, September 1998. 

Operations Support Group Report, June 1999. 
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Industry Information Security 

Investigation Group / Period of Activity 

Industry Information Security (IIS) Task Force 

August 19,1986-September 22,1988 

Issue Background 

Based on widespread concern within the Government 
regarding the protection of sensitive but unclassified 
information, the President requested that the NSTAC 
identify initiatives that would facilitate the protection 
of sensifive information processing systems. On 
August 19, 1986, the NSTAC lES established the 
IIS Task Force to develop industry’s perspective 
on the issue. The original IIS Task Force defined 
and idenfified sensifive information categories, 
the relationship between telecommunications 
and automated information systems, an analysis 
methodology, and areas for further investigation. The 
lES then established a follow-on IIS Task Force to 
improve information security in telecommunications 
and automated information systems. The IIS Task 
Force submitted its final reporf to the NSTAC on 
September 22, 1988. It contained 10 conclusions 
and eight recommendations. The NSTAC approved 
the report and forwarded it to the President. 

History of NSTAC Actions and Recommendations 

On September 22, 1988, the NSTAC approved 
the IIS Task Force final reporf and forwarded it to 
the President. 

Actions Resulting from NSTAC Recommendations 

The NSA continued and expanded the Protected 
Communication Zone program. NSA developed 
standardized encryption modules for terminal unit 
platforms and reendorsed the Data Encryption 
Standard algorithm. Federal agencies continued the 
information security education program. 


Reports Issued 

The IIS Task Force Report, Volume I, November 1986. 

The IIS Task Force Report, Volume II, Appendices, November 1986. 

Status Report of the IIS Task Force, October 1987. 

Final Report of the IIS Task Force—Industry Information 
Protection, Volume I, June 1988. 

Final Report of the IIS Task Force—Industry Information 
Protection, Volume If Appendices, June 1988. 

Final Report of the IIS Task Force Industry Information 
Protection, Volume III, Annotated Bibliography, June 1988. 
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Information Assurance 

Investigation Group / Period of Activity 

Information Assurance Task Force (lATF) 

May 15,1995-April 22,1997 

Information Infrastructure Group (MG) 

April 22,1997-September 23,1999 

Financial Services Task Force (FSTF) 

March 2003-April 2004 

Issue Background 

At the NSTAC XVII Meeting, the Director of the 
National Security Agency briefed fhe NSTAC 
Principals on threats to U.S. infrastructures. 

In the ensuing months, the NSTAC’s Issues 
Group sponsored a number of meetings with 
representatives from the national security 
community, law enforcement, and civil departments 
and agencies to discuss information warfare 
(defensive) and lA issues. At the May 15, 1995, 
lES Working Session, the members approved 
establishing the lATF to serve as a focal point for 
lA issues. More specifically, the lES charged the 
lATF to cooperate with the U.S. Government to 
identify critical national infrastructures and their 
importance to the national interest, schedule 
elements for assessment, and propose lA policy 
recommendations to the President. 

The lATF worked closely with industry and 
Government representatives to identify critical 
national infrastructures and ultimately selected 
three for study: electric power, financial services, 
and transportation. To address the distinctive 
characteristics of those infrastructures, the lATF 
established three risk assessment subgroups to 
examine each infrastructure’s dependence on 
information technology and the associated lA risks 
to its information systems. Following NSTAC XIX, the 
lES renamed the lATF the IIG and gave it the mission 
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to continue acting as the focal point for NSTAC lA 
and CIP issues. 

In investigating lA/CIP issues, the IIG worked 
closely with the President's Commission on 
Critical Infrastructure Protection and other Federal 
organizations concerned with examining physical and 
cyber threats to the Nation’s critical infrastructures. 
Federal efforts in this arena culminated with the 
release of presidential policy guidance—PDD 
63, Critical Infrastructure Protection, May 22, 1998. 
Subsequently, PDD-63 implementation became a 
focal point for the IIG’s activities. 

History of NSTAC Actions and Recommendations 

The lATF’s Electric Power Risk Assessment 
Subgroup completed its lA risk assessment report 
in preparation for the March 1997 NSTAC XIX 
Meeting. In compiling information for this report, 
the Electric Power Risk Assessment Subgroup met 
with representatives from eight electric utilities, 
two industry associations, an electric power 
pool, equipment manufacturers, and numerous 
industry consultants. Based on these interviews, 
the subgroup assessed the extent to which the 
infrastructure depends on information systems and 
how associated vulnerabilities placed the electric 
power industry at increased risk to denial-of-service 
attacks. Based on the subgroup’s findings, the 
NSTAC recommended that the President: 

► Assign the appropriate department or agency 
to develop and conduct an ongoing program 
within the electric power industry to increase 
the awareness of vulnerabilities and available or 
emerging solutions; 

► Establish an NSTAC-like advisory committee 
to enhance industry/Government cooperation 
regarding regulatory changes affecting electric 
power; and 

► Provide threat information and consider providing 
incentives for industry to work with Government to 
develop and deploy appropriate security features 
for the electric power industry. 
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The IIG’s Financial Services Risk Assessment 
Subgroup submitted its final recommendations 
in a report to NSTAC XX in December 1997. In 
compiling information for this report, the Financial 
Services Risk Assessment Subgroup conducted 
confidential interviews with institutions representing 
money center banks, securities credit firms, credit 
card associations, third-party processors, industry 
utilities, industry associations, and Federal regulatory 
agencies responsible for industry oversight. 

The subgroup found fhat indusfry organizations 
treated security measures as fundamental risk 
controls—that a system of independenf, mutually 
reinforcing checks and balances within critical 
systems and networks was unique to the financial 
services industry, providing a high level of infegrity. 
The subgroup concluded that at the national 
level the industry was sufficiently protected and 
prepared to address a range of threafs. However, 
the subgroup identified securify implicafions 
and potential vulnerabilities associated with the 
industry’s dependence on the telecommunications 
infrastructure being subjected to deregulation, the 
integration of dissimilar information systems and 
networks resulting from mergers and acquisitions, 
and the introduction of Web-based financial services. 
Based on the Financial Services Risk Assessment Report, 
the NSTAC recommended that the President: 

► Assign to the appropriate department or agency 
the mission of idenfifying exfernal threats and risk 
mitigation to the financial services infrastructure, 
facilitating the sharing of informafion between 
industry and Government; 

► Assign the appropriate department or agency 
the task of working wifh the private sector to 
develop a mutually agreeable solution for effective 
background investigations for sensitive positions; 

► Assign the appropriate department or agency 
the task of monitoring the new/emerging areas of 
electronic money and commerce, including new 
payment services; and 


► Ensure that the NSTAC continues to have at least 
one member from the financial services industry. 

The IIG’s Transportation Risk Assessment Subgroup 
sponsored a workshop on September 10, 1997, to 
discuss the transportation information infrastructure. 
Topics included Intermodal Information 
dependencies, Industry/Government information 
sharing, transportation information infrastructure 
vulnerabilities, and Government understanding of the 
transportation industry’s information infrastructure 
vulnerabilities. The workshop, held at Fort 
McPherson, Georgia, included representatives from 
many major transportafion companies, including 
airlines, multimodal carriers, rail, highway, mass 
transit, and maritime. The subgroup documented 
its findings in an Interim Transportation Information Risk 
Assessment Report to NSTAC XX in December 1997. 

The IIG confinued to investigate transportation 
information infrastructure issues through the NSTAC 
XXII cycle. As part of fhat effort, the IIG worked 
with Department of Transportation representatives 
to conduct outreach meetings with transportation 
industry associations to better understand intermodal 
transportation trends. The IIG also hosted another 
workshop on March 3 and 4, 1999, In Tampa, 

Florida, which included representation from each 
fransportafion sector. Participants discussed industry 
trends, including increased reliance on information 
technology and the rapid growth of intermodal 
transportation. Workshop findings were categorized 
Into four areas: 

(1) threats and deterrents, (2) vulnerabilities, 

(3) protection measures, and (4) infrastructure-wide 
issues. Based on the IIG’s final Transportation Risk 
Assessment Report, the NSTAC recommended that 
the President: 

► Continue support for the efforts of the 
Department of Transportafion to promote 
outreach and awareness within the 
transportation infrastructure as expressed in 
P D D-63, Critical Infrastructure Protection. 
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As part of the above recommendation, the 
NSTAC specifically recommended that the 
President and the Administration ensure 
support for the following activities: 

► Timely dissemination of Government 
information on physical and cyber threats to the 
transportation industry; 

► Government research and development programs 
to design infrastructure assurance tools and 
techniques to counter emerging cyber threats to 
the transportation information infrastructure; 

► Industry/Government efforts to examine emerging 
industry-wide vulnerabilities such as those related 
to the Global Positioning System; and 

► Future Department of Transportation conferences 
to simulate intermodal and, where appropriate, 
inter-infrastructure information exchange on 
threats, vulnerabilities, and best practices. 

Following NSTAC XX, the IIG formed an Electronic 
Commerce (EO/Cyber Security Subgroup to address 
two issues: the short-term, technical, and tIme-sensItIve 
issue relating to cyber security training and forensics; 
and the long-term, policy oriented, high-level Issue 
of the NS/EP Implications of EC. In addressing the 
short-term issue, the subgroup found that industry 
and Government needed a stronger partnership to 
establish appropriate levels of trust and understanding 
and to foster cooperation in addressing cyber security 
issues. At the September 1998 NSTAC XXI meeting, 
the NSTAC approved the subgroup’s study paper 
along with the IIG report and made the following 
recommendation: 

► The President should direct the appropriate 
departments and agencies to continue working 
with the NSTAC to develop policies, procedures, 
techniques, and tools to facilitate industry/ 
Government cooperation on cyber security. 

To address the long-term issue, the IIG continued to 
investigate the NS/EP implications associated with 
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the adoption of EC within industry and Government. 
The group focused its efforts on issues associated 
with the changing business and security processes 
and policies necessary to implement EC. The IIG’s 
conclusions and recommendations were included in 
its June 1999 report to NSTAC XXII. Based on that 
report, the NSTAC recommended that the President: 

► In accordance with responsibilities and existing 
mechanisms established by E.O. 12472, 
Assignment of National Security and Emergency 
Preparedness Telecommunications Functions, 
designate a focal point for examining the NS/EP 
Issues related to widespread adoption of EC within 
the Government; and 

► Direct Federal departments and agencies, in 
cooperation with an established Federal focal 
point, to assess the effect of EC technologies on 
their NS/EP operations. 

At the NSTAC XXI Executive Session, the U.S. 
Attorney General requested that the NSTAC and 
the DOJ work together to address cyber security 
and crime. The lES determined that the projects 
DOJ suggested should not be addressed by the 
NSTAC at large but agreed that the NSTAC could 
help facilitate a partnership between the DOJ and 
Individual corporations. 

This agreement resulted in a meeting on 
March 5, 1999, between the NSTAC chair and 
the Attorney General where they discussed the 
possibilities for industry and Government participation 
on mutually beneficial projects. These efforts 
ultimately resulted in DOJ’s Cyber Citizen program. 

Building on past NSTAC efforts in addressing lA 
and CIP issues, the IIG continued to coordinate 
with Federal officials responsible for PDD-63 
implementation during the NSTAC XXII cycle. 
Specifically, In accordance with the PDD-63 
emphasis on public-private partnerships, IIG 
members focused on sharing the lessons and 
successes of NSTAC and offering it as a possible 
model for other infrastructures. 


81 



PREVIOUSLY ADDRESSED ISSUES ◄ NSTAC XXIX Issue Review 


The President’s National Security Telecommunications Advisory Committee 


Actions Resulting from NSTAC Recommendations 

NSTAC advice to the President and the 
Administration has had significant applicability 
to PDD-63 implementation. PDD-63 directs 
Federal lead agencies to identify infrasfructure 
sector coordinators within industry to provide 
perspective on CIP programs. At NSTAC XXI in 
September 1998, the NSTAC concluded that more 
than one entity or sector coordinator would be 
required to represent the diverse information and 
communications sector. In February 1999, following 
lES outreach to the Administration on the issue, 
the Department of Commerce acfed in concert 
with NSTAC advice and selected three Industry 
associations to serve as sector coordinators for the 
information and communications sector. 

PDD-63 also calls for the private sector to explore 
the feasibility of establishing one or multiple ISAC. 

On the basis of the December 1997 NSTAC 
recommendation regarding a cross-infrastructure 
National Coordinating Mechanism, lES representatives 
engaged in a dialogue with senior Administration 
officials on the prospects of creating multiple 
infrastructure-based ISACs. That dialogue was 
important to the eventual decision to establish the 
National Coordinating Center for Telecommunications 
as an ISAC for telecommunications. 

Einally, PDD-63 emphasizes the importance of 
relying on nonregulatory solutions to address 
infrastructure vulnerabilities. In satisfying fhis 
objective, the Administration underscored the value 
of promoting industry standards and best practices 
to improve lA. That approach is consistent with 
and follows on the December 1997 NSTAC XX 
recommendation regarding the creation of a private 
sector Information Systems Security Board. 


Reports Issued 

Information Assurance Task Force Report, March 1997. 

Electric Power Information Assurance Risk Assessment Report, 
March 1997. 

Information Infrastructure Group Report, December 1997. 

Financial Services Risk Assessment Report, December 1997. 

Interim Transportation Information Risk Assessment Report, 
December 1997. 

Cyber Crime Point Paper, December 1997. 

Information Infrastructure Group Report, September 1998. 

Cyber Security Training and Forensics Issue Paper, 

September 1998. 

Information Infrastructure Group Report, June 1999. 

Transportation Information Infrastructure Risk Assessment 
Report,\\ine 1999. 

Report on NS/EP Implications of Electronic Commerce, 

June 1999. 
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Information Sharing/Critical 
Infrastructure Protection 

Investigation Group / Period of Activity 

Information Sharing/Critical Infrastructure Protection 
Task Force (IS/CIPTF) 

September 1999 - March 2002 

National Plan to Defend Critical Infrastructures 
Task Force (NPTF) 

June 20,2001 - September 20,2001 

Issue Background 

In investigating Information Assurance issues, 
the NSTAC worked closely with the President’s 
Commission on Critical Infrastructure Protection 
and other Federal organizations concerned with 
examining physical and cyber threats to the Nation’s 
critical infrastructures. Federal efforts in this arena 
culminated with the release of presidential policy 
guidance—Presidential Decision Directive (PDD) 

63, Critical Infrastructure Protection, May 22, 1998. 
Subsequently, PDD-63 implementation became a 
focal point for NSTAC activities. 

Following a reevaluation of NSTAC subgroups in 
September 1999, the lES created the IS/CIPTF to 
address information sharing issues associated with 
critical infrastructure protection (CIP). Specifically, 
the lES directed the task force to, among other 
things, continue interaction with Government 
leaders responsible for PDD-63 implementation, and 
examine mechanisms and processes for protected, 
operational information sharing that would help 
achieve the goals of PDD-63. 

At NSTAC XXIV, the National Coordinator for Security, 
Infrastructure Protection, and Counter-terrorism 
requested the NSTAC’s assistance in developing the 
Administration’s National Plan for Critical Infrastructure 
Protection. The NSTAC’s lES established the NPTE 
to draft a response to the National Coordinator’s 
request. Subsequently, NPTE leadership met with 
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National Security Council and Critical Infrastructure 
Assurance Office (CIAO) staff to discuss approaches 
for providing input to the national plan. The chosen 
approach focused on providing input on capabilities 
for national information sharing, analysis, and 
dissemination to counter cyber threats. 

History of NSTAC Actions and Recommendations 

Building on outreach work conducted by the NSTAC 
Information Infrastructure Group during the NSTAC 
XXII cycle (see the Information Assurance section 
in this NSTAC Issue Review), the IS/CIPTE continued to 
provide input to the Director, CIAO, on the National Plan 
for Information Systems Protection (Version 1.0). This plan was 
the first major element of a more comprehensive effort 
by the Federal Government to protect and defend the 
Nation against cyber vulnerabilities and disruptions. 
The IS/CIPTF members shared industry concerns and 
developed a dialogue with the Government that helped 
to shape the plan. In its May 2000 report to NSTAC 
XXIII, the IS/CIPTF provided NSTAC-recommended 
input to the plan regarding the National Coordinating 
Center for Telecommunications (NCC) as the 
Information Sharing and Analysis Center (ISAC) for the 
telecommunications industry. 

In parallel with its work associated with the National 
Plan for Information Systems Protection (Version 1.0), and as 
part of continuous efforts to share NSTAC expertise 
with industry and Government, the IS/CIPTF 
monitored the development of the Partnership for 
Critical Infrastructure Security. The Partnership is 
an industry/Government effort to raise awareness 
about critical infrastructure security and facilitates 
industry participation in the national process to 
address CIP. Through individual NSTAC member 
company participation, the NSTAC shared expertise, 
successes, lessons learned, and experiences to 
further facilitate the development of the Partnership 
in support of PDD-63 objectives. 

The IS/CIPTF also examined mechanisms and 
processes for protected, operational information 
sharing that would help achieve the goals of 
PDD-63 and further the role of the NCC as an 
ISAC for telecommunications. (See the Industry/ 
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Government Information Sharing and Response 
section in this NSTAC Issue Review ^o\' a discussion of 
how the NSTAC's support for the evoiving role of the 
NCC helped pave the way for the establishment of 
the NCC as an ISAC for telecommunications). 

Specifically, the task force examined the NCC's 
historical experiences to determine how and what 
information is shared and the utility of information 
sharing for industry and Government. As part of the 
study, the IS/CIPTF examined the NCC's Year 2000 
(Y2K) experiences for lessons learned thaf could 
benefit infrastructure protection efforts. The task 
force also identified benefits of information sharing to 
both industry and Government. 

The IS/CIPTF also requested that the NSTAC’s 
Legislative and Regulatory Working Group (LRWG) 
examine the Freedom of Information Act {FO\A) as a 
potential impediment to information sharing and 
report its findings to the task force. The LRWG’s 
work provided the task force with the background 
necessary to voice industry concerns about the need 
for legal provisions to protect critical infrastructure 
protection-related information from disclosure. 

The IS/CIPTF documented its findings in its report to 
NSTAC XIII in May 2000. The IS/CIPTF concluded 
that historical and Y2K experiences demonstrate 
information sharing to be a worthwhile effort; 
however, for widespread information sharing over 
an extended period of time to take place, legal, 
operational, and perceived impediments must be 
overcome. Based on the IS/CIPTF’s report, the 
NSTAC recommended that the President: 

► Support legislation similar to the Y2KInformation 
and Readiness Disclosure ActtUat would protect CIP 
information voluntarily shared with the appropriate 
departments and agencies from disclosure under 
FOIA and limit liability. 

At the May 16, 2000, NSTAC XXIII Meeting, a 
Government request was made for industry advice 
and recommendations for revision of the National Plan 
for Information Systems Protection. During the NSTAC XXIV 


cycle, the IS/CIPTF developed a response based 
on the NSTAC’s experience with proven processes 
for industry and Government partnership at the 
technical, operational, and policy levels. Specifically, 
the task force documented NSTAC findings relafed 
to the three broad objectives of Version 1.0 of the 
national plan—Prepare and Prevent, Detect and 
Respond, and Build Strong Foundations—that 
should be reflected in Version 2.0 of the plan. In 
addition, the task force proposed that a new broad 
objective—International Considerations—be included 
in the plan’s Version 2.0. The NSTAC approved the 
response, and forwarded it to the President. This 
information was also shared with the Information 
and Communications (l&C) Sector Coordinators: the 
U.S. Telecom Association, the Telecommunications 
Industry Association, and the Information Technology 
Association of America; and the l&C Sector Liaison, 
NTIA. The information was subsequently included in 
the l&C Sector Report that NTIA forwarded it to the 
President in April 2001. 

During the NSTAC XXIV cycle, the IS/CIPTF also 
continued to address barriers to sharing CIP-related 
information, including possible law enforcement 
restrictions on industry sharing network intrusion 
data with ISACs or similar information sharing 
forums. The task force requested that the NSTAC 
and Government Network Security and Information 
Exchanges (NSIE) assist in investigating this issue. 

The NSTAC NSIE representatives reported that, 
historically, they had not discussed intrusions 
into their networks and systems with anyone else 
after reporting them to law enforcement because 
case agents had told them that doing so might 
compromise the investigation of their cases. In 
working with the Department of Justice, the NSIEs 
found thaf although common practice discourages 
victims of such crimes from sharing informafion, 
no laws or policies prohibit victims from discussing 
crimes againsf them even after they have reported 
them to law enforcement. To address the situation, 
the Chief, Computer Crime and Intellectual Property 
Section, Department of Justice, agreed to work 
with the law enforcement community to implement 
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policies that encourage victims to share such 
information, and to educate victims on those policies. 
The NSIEs conciuded that itwouid be necessary 
for the private sector to ensure that personnel 
interacting with law enforcement on such cases are 
aware that they are permitted and encouraged to 
share this information for network security purposes 
using appropriate mechanisms. 

At the June 6, 2001, NSTAC XXIV meeting, the 
National Coordinator requested the NSTAG’S assistance 
in developing the Bush Administration’s National 
Plan for Critical Infrastructure Assurance. At that meeting. 
Federal officials also briefed a new national initiative 
for information sharing and dissemination, the Cyber 
Warning Information Network (CWIN), to the NSTAC 
as part of the discussion on national information 
sharing capabilities. The lES formed the NPTF to 
discuss the proposed CWIN and develop further input 
to the national plan. The NPTF held discussions with 
members of the Government’s CWIN Working Group 
to gain a better understanding of the CWIN initiative. 
The NSTAC input to the national plan—based on the 
NPTF work—included an industry-based assessment 
of a national information sharing, analysis, and 
dissemination capability for addressing “cyber crises.” 
The assessment considered CWIN as a part of that 
larger national capability. 

The NSTAC’s input focused on the need for a 
recognized, authoritative, national-level capability to 
disseminate warnings and facilitate response and 
mitigation efforts for cyber crises across the Nation’s 
infrastructures. The NSTAC also concluded that key 
elements of such a capability spanning public and 
private sectors should include information collection 
and sharing, information analysis, dissemination of 
alerts and warnings, and post-event analysis. 

The NSTAC recognized that conceptualizing the 
architecture for a national capability for addressing 
cyber crises is a complex undertaking. Before a 
national capability can become fully operational, 
industry and Government must address—individually 
and in collaboration—numerous policy, legal, 
financial, operational, and technical issues. 
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Nevertheless, the NSTAC clearly determined that 
the ISACs should be leveraged by both industry and 
Government in building such a national capability 
and should serve as the Government’s primary 
means of interface with industry. In addition, the 
NSTAC determined that industry and Government 
should develop communications mechanisms to link 
the ISACs to each other as well as with Government. 
The NSTAC also found that infrastructures should 
consider alternative means for communicating 
during emergencies as appropriate to the sector. For 
example, the telecommunications industry developed 
an alerting and coordination mechanism, which 
connects key elements of the sector and provides 
reliable and survivable communications in the event 
other communications mechanisms are unavailable 
or requirements warrant its use. The NSTAC 
forwarded its report containing input on the national 
plan to the President in November 2001. 

Reports Issued 

Information Sharing/Critical Infrastructure Protection 
Task Force Report, May 2000. 

The NSTAC's Response to the National Plan, April 2001. 

Information Sharing for Critical Infrastructure Protection 
Task Force Report, June 2001. 

The NSTAC’s Input to the National Plan: An Assessment of 
Industry's Role in National Level Information Sharing, Analysis, 
and Dissemination Capabilities for Addressing Cyber Crises, 
November 2001. 
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Intelligent Networks 

Investigation Group / Period of Activity 

Intelligent Networks (IN) Task Force 

August 1989 - October 1991 

Issue Background 

The Telecommunications System Survivability Task 
Force selected IN as one of five study topics focused 
on determining the effect of new technologies 
on telecommunications systems survivability. 

In June 1989, the NSTAC charged the lES with 
continuing the intelligent network effort on an interim 
basis pending review by the lES PWG. Upon PWG 
recommendation that intelligent networks become a 
full task force, the lES established the IN Task Force 
in August 1989. 

NSTAC XI extended the activities of the IN Task 
Force until NSTAC XII, December 13, 1990. To meet 
its charge, the task force worked with the OMNCS 
to derive a set of desired NS/EP user features and 
compared them with intelligent network services. 

The task force determined the advantages and 
disadvantages of identified intelligent network 
services for NS/EP telecommunications, including 
interoperability considerations. The lES extended the 
IN Task Force until NSTAC XIII to allow the OWG to 
work with the task force and the OMNCS to refine the 
recommendations in the task force final report. 

The IN Task Force presented its final report and 
recommendations at the November 1990 lES 
meeting. The lES referred the report to the lES OWG 
for evaluation. The OWG’s New Technology Panel 
developed an executive report on I Ns in response to 
the lES charge to evaluate and refine the conclusions 
and recommendations of the IN Task Force Final Report. 
NSTAC XIII directed the lES to disband the IN Task 
Force. In its Executive Report to the President, 

NSTAC offered to provide additional support to 
assist the Government in meeting the challenges of 
intelligent networks. 
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History of NSTAC Actions and Recommendations 

At NSTAC XIII, October 3, 1991, the NSTAC approved 
the following recommendation to the President in the 
IES Executive Report on Intelligent Networks: 

► The Government should establish an IN Program 
Office to ensure advantages of evolving intelligent 
networks are incorporated into planning for 

and procurement of Government NS/EP 
telecommunications. 

Actions Resulting from NSTAC Recommendations 

The OMNCS established an Advanced Intelligent 
Networks (AIN) Program Office in its Office of Plans 
and Programs. The primary objectives of the AIN 
Program Office are to: 

► Identify AIN service needs for NS/EP 
telecommunications; 

► Determine the current status and planned 
capabilities of AIN technology; 

► Demonstrate AIN capabilities supporting NS/EP 
requirements; 

► Assess the status of AIN standards activities; and 

► Develop and implement a strategy for influencing 
the direction of AIN standards. 

The AIN Program Office awarded a 5-year AIN 
NS/EP contract to Bellcore to provide a mechanism 
for collecting IN and AIN data, analyzing new 
technology developments, and demonstrating 
AIN-based applications. By meeting those 
objectives and obtaining pertinent information 
from Bellcore, the OMNCS will help ensure NS/EP 
telecommunications users benefit from the evolving 
AIN technology. 
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Reports Issued 

The IN Task Force Final Report: The Impact of IN on NS/EP 
Telecommunications, November 7,1990. 

The Industry Executive Subcommittee: Executive Report on IN, 
October 3,1991. 
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International Diplomatic 
Telecommunications 


Reports Issued 


IDT Task Force Interim Report to lES, January 16,1984. 


Investigation Group / Period of Activity 


IDT Task Force Final Report, March 15,1984. 


International Diplomatic Telecommunications (IDT) 

Task Force 

September 27,1983-December 12,1984 

Issue Background 

National Security Decision Directive (NSDD) 

No. 97 stipulates that U.S. Government missions 
and posts overseas must have the required 
telecommunications facilities and services to satisfy 
the Nation’s needs during international emergencies. 
The National Communications System requested that 
the NSTAC advise the Department of State (DOS) 
on the vulnerability and risks inherent in overseas 
leased networks and offer remedial measures. On 
September 27, 1983, the NSTAC lES formed the 
IDT Task Force to study the issue and develop 
recommendations. 

History of NSTAC Actions and Recommendations 

In April 1984, the NSTAC forwarded the following 
recommendations on IDT to the President: 

► Review vulnerabilities and risks at overseas 
diplomatic posts using the guidelines established 
by the IDT Task Force; and 

► Establish a DOS point of contact to serve the 
telecommunications needs of foreign missions 
operating in the United States. 

The NSTAC also instructed the lES to assist 
the DOS in determining the feasibility of using 
telecommunications resources owned by U.S. 
industries to support diplomatic requirements during 
international emergencies. 
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International National Security 
and Emergency Preparedness 
Telecommunications 

Investigation Grouft / Period of Activity 

Ad Hoc Group of the Industry Executive Subcommittee (lES) 
Plans Working Group (PWG) 

July 25,1990-March 1,1991 

Issue Background 

Effective worldwide communications directly 
influences the Nation’s ability to promote its national 
security interests in the global arena and to meet 
its international responsibilities. Changes in the 
international environment will profoundly affect the 
telecommunications capabilities needed to support 
the U.S. NS/EP posture. Significant changes In the 
international telecommunications Industry-Eastern 
European modernization, U.S. carrier involvement In 
other countries, and development of new technologies 
and international standards will also affect the means 
for providing the requisite capabilities. 

During the last few years, the industry/Government 
NS/EP telecommunications planning community 
demonstrated increasing interest in and concern 
about the international dimensions of NS/EP 
telecommunications. After considering a variety of 
potential problem areas, the ad hoc group concluded 
that although modern telecommunications 
technologies are increasingly capable of supporting 
NS/EP needs. Inadequate planning for using such 
technologies might impede the President’s ability to 
effectively react to international events. 

The ad hoc group recommended to the 
October 24, 1990, PWG meeting that it form a 
task force to: 

► Identify and assess the biggest problem areas 
affecting future U.S. international NS/EP 
telecommunications capabilities; and 
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► Develop recommendations for an U.S. 

international NS/EP telecommunications plan of 
action using both Government and private sector 
telecommunications resources and capabilities 
to meet evolving U.S. international NS/EP 
telecommunications needs. 

The PWG concluded that the ad hoc group needed 
to refocus the issue and directed it to review the 
international NS/EP telecommunications issue again 
with a sharper focus of the original charge. The 
ad hoc group met several times and presented a 
revised set of proposed task force charges at the 
March 6, 1991, PWG Meeting. The PWG concluded 
that an international task force was not warranted, 
but that the PWG Chair should send a letter to 
the Deputy Manager, NCS, advising of the ad hoc 
group’s findings and gauging NSTAC’s willingness to 
address the international Issue if requested by the 
Government. The Deputy Manager, NCS, forwarded 
a copy of the PWG Chair’s letter to NCS principals 
to convey the PWG’s willingness to assist the 
Government in its effort to enhance overseas NS/EP 
communications. 


Report Issued 

Ad Hoc International Group of the lES Plans Working Group, 
International National Security and Emergency Preparedness 
Telecommunications Issue, October 1990. 
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Last Mile Bandwidth Availability 

Investigation Group / Period of Activity 

Last Mile Bandwidth Availability Task Force (LMBATF) 

January 18,2001 - March 6,2002 


Issue Background 

At the 23rd meeting of the President’s NSTAC on 
May 16, 2000, the Deputy Secretary of Defense, and 
the Manager, NCS, addressed the inabiiity of the 
Nation's miiitary and national security organizations 
to obtain the timely provisioning of high-bandwidth 
circuits at the local level, referred to as the “last 
mile.” Subsequently, in an October 2000 letter to the 
NSTAC Chair, the NCS Manager asked the NSTAC 
to recommend what the Government could do to 
expedite the provisioning of “last mile” bandwidth or 
mitigate the provisioning periods for such services. 

After scoping the key issues in coordination with 
Government, the NSTAC's lES formed the LMBATF 
at its January 18, 2001, Working Session. The 
task force was to examine the root causes of the 
provisioning periods, how the Government might 
work with industry to reduce provisioning times or 
otherwise mitigate their effects, and what policy- 
based solutions could be applied to the provisioning 
of high-bandwidth circuits for NS/EP services. 

The task force included broad represenfation of 
NSTAC member companies and NCS departments 
and agencies. During the remainder of the NSTAC 
XXIV cycle, the LMBATF gathered data from both 
industry organizations and the Federal Government 
regarding their experiences with provisioning at 
the local level. The task force also solicited input 
from felecommunications service providers on fhe 
processes for provisioning at the local level and 
the factors affecting provisioning periods. Based 
on the input, the LMBATF agreed that the scope of 
the study should apply to non-universally available 
services throughout the United States, including fiber 
optics, T1 and T3 lines, integrated services digital 
network and digital subscriber line technologies. 
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History of NSTAC Actions and Recommendations 

The LMBATF concluded its analysis of the “last 
mile” provisionings during the NSTAC XXV cycle and 
presented its findings and recommendations in the 
M a rc h 2002 "Last Mile" Bandwidth A vailability Task Force 
Report at NSTAC XXV. The task force found thaf the 
provisioning periods for high-bandwidth services in the 
“last mile” are affected by a combination of complex 
factors, such as intricate legislative, regulatory, 
and economic environments; challenging site 
locations; and contracting policies and procedures. 
Furthermore, while the Telecommunications Act of 
1996 sought to encourage competition, many carriers, 
both incumbent and competitive, are dissatisfied 
with the results. This, combined with a high level of 
marketplace uncertainty, has reduced infrastructure 
investment by incumbents and competitors alike. 

The task force also concluded that current 
Government contracting arrangements also create 
difficulties. In many instances, contracts are only 
vehicles for ordering services and do not represent 
a firm commitment on the part of fhe Government 
to purchase a service. Because such commitments 
are not in place, the carrier cannot be assured of 
recovering ifs infrastructure investment. Furthermore, 
when the business case warrants such investment, 
carriers are limited by contracts’ failure to list the 
sites to be served or the types and quantities of 
services fo be provided. Problems also occur because 
Governmenf contracts legally bind the prime contractor 
but make no explicit demands on subcontractors on 
which the prime contractor depends. 

The Government is adversely affected by funding 
cycles that do not coincide with the time needed 
to obtain high-bandwidth services. Funding is not 
allocated until the user identifies an immediate need 
and obtains approval. However, the deployment of 
high-bandwidth infrastructure often requires years 
of planning and coordination for allocating capital, 
obtaining rights-of-way authority, and installing 
service facilities. The imperfect intersection of these 
inherently mismatched processes often results in 
lengthy provisioning periods. 
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The negative consequences of the funding process 
are often exacerbated by a fragmented management 
structure. In many cases, project managers are 
responsible for separate portions of the network, with 
no single entity responsible for planning or monitoring 
the provisioning of end-to-end service. Overall project 
management Is vital to effective network deployment, 
systems integration, and achievement of project 
goals. Because telecommunications services are 
provided by a multitude of companies, users must 
track service orders and manage the network from a 
centralized perspective. 

The task force also studied whether the TSP System 
can be used to expedite “last mile” provisioning 
requests because TSP provisioning assignments 
are used by the NS/EP community to facilitate 
the expedited installation of telecommunications 
circuits that otherwise could not be installed within 
the required time frame. Although TSP seems to be 
an applicable solution for many NS/EP “last mile” 
bandwidth requests, TSP provisioning assignments 
can only be applied to services originating from new 
business requirements. Therefore, TSP provisioning 
cannot be used to replace or transfer existing services, 
such as those associated with the contract transition. 
Finally, TSP cannot be used to make up for time 
lost because of inadequate planning or logistical 
difficulties. According to these parameters, many 
“last mile” provisioning requests are not eligible for 
the TSP System, even if the requested service could 
be used for executing an agency's NS/EP mission. 

An alternative for meeting Government organizations’ 
service requirements may be the implementation 
of alternative technologies to fulfill bandwidth 
requirements on a temporary or permanent basis. 

Based on this analysis, the LMBATF report 
recommended that the President, in accordance with 
responsibilities and existing mechanisms established 
by Executive Order (E.O.) 12472, Assignment of National 
Security and Emergency Preparedness Telecommunications 
Functions and other existing authority: 


► Direct the appropriate departments and agencies, 
in coordination with industry, to reevaluate 

their communications service contracting and 
purchasing procedures and practices and take 
action to: 

• Provide sufficient authority and flexibility to 
meet their needs, consistent with current 
conditions 

• Allow long lead-time ordering and funding 
commitments based on projected 
requirements 

• Allow infrastructure funding where necessary 
for anticipated future needs or to accelerate 
installation so that customer requirements 
can be met 

• Share or assume risk for new service capital 
investment to ensure timely delivery 

• Allow and provide for performance incentives 
for all performing parties: industry and 
Government, organizational and individual 

• Require end-to-end project management of 
communications service ordering and delivery. 

► Direct the Federal Government Chief Information 
Officers Council to propose, and assist in 
implementing, improved Government contracting 
practices for communications services that will 
enhance the availability of broadband services for 
the “last mile.” 

In support of the recommendations, NSTAC “Last 

Mile" Task Force Report also suggested that both industry 

and Government encourage: 

► Government contracting officers to engage all 
industry and Government representatives in joint 
planning sessions; 

► Industry representatives to work with Government 
contracting officers in joint planning sessions; 


94 



The President’s National Security Telecommunications Advisory Committee 


NSTAC XXIX Issue Review ► PREVIOUSLY ADDRESSED ISSUES 


Report Issued 

“Last Mile" Bandwidth Availability Task Force Report 
to NSTAC XXV, March 2002. 

► Contracting practices that require end users 
to identity requirements and to communicate 
future needs to network providers. End users 
and network providers shouid jointly identify 
complicating factors and discuss alternatives. 

Finally, the NSTAC “Last Mile” Bandwidth Availability Task 

force ffeporf encouraged Government to: 

► Establish realistic service requirements and 
timelines and select the service options that meet 
its needs with acceptable risk; 

► Convene a working group consisting of industry 
and Government stakeholders in the provisioning 
process to develop and recommend a streamlined 
approach to all aspects of the process, including 
planning, ordering, and tracking. The resulting 
proposal should be comprehensive, simplifying 
steps and organizations as much as possible; 
should share information appropriately at all 
points; and should support flexibility in meeting 
end-user needs. The working group should give 
strong consideration to a single Government 
database to support the process and a single 
point of contact, such as a phone number or an 
e-mail address, to ensure accuracy of information 
and provide exception handling; and 

► Establish or contract for project managers who 
have all necessary management control tools at 
their disposal; access to pertinent information; and 
experience, responsibility, and authority for obtaining 
and overseeing delivery of the end-to-end service. 

The LMBATF concluded its activities upon NSTAC 

approval of its report. 


► Use of a contract structure that makes all carriers 
involved in the delivery of the service parties 
to the contract with direct accountability to the 
Government contracting entity; and 
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National Coordinating Mechanism 

Investigating Group / Period of Activity 

National Coordinating Mechanism (NCM) Task Force 

December 14,1982-November 15,1984 

Issue Background 

The NSTAC recognized the need to establish 
a mechanism for coordinating industry and 
Government responses to the Government’s NS/EP 
telecommunication service requirements in the 
post-divestiture environment. As a result, NSTAC 
formed fhe NCM Task Force in December 1982, 
and charged it to identify and establish the most 
cost-effective mechanism to coordinate industry-wide 
responses to NS/EP telecommunications requests. 

History of NSTAC Actions and Recommendations 

The NSTAC forwarded a series of NCM 
recommendafions to the President in 1983 and 
1984. The NCC is the most significant result of fhese 
recommendafions. Esfablished on January 3, 1984, 
the NCC is a joint industry/Government operations 
center that supports the Federal Government's 
NS/EP telecommunication requirements. 

Actions Resulting from NSTAC Recommendations 

The TSS Task Force reviewed Government actions 
taken on the NSTAC's NCM recommendations 
and concluded that the NCM recommendations 
were carried out promptly and effectively. The task 
force recommended conflnuing NCS member 
organizations’ representation in the NCC, and 
continuing Government dissemination of NS/EP 
information. The NSTAC approved the TSS Task 
Force’s findings and recommendations on the 
NCM and forwarded them to the President on 
September 22, 1988. 

The NCS member agencies’ representation in 
the NCC continues, as does the Government’s 
dissemination of NS/EP informafion. See the NCC 
Task Force section in the NSTAC XXIX Issues section, 
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as well as the Industry/Government Coordination and 
Response section in this NSTAC Issue Review tor a fuller 
discussion of recenf NCC actions. 

Reports Issued 

NCM Task Force Report, May 16,1983. 

NCM Implementation Plan (Final Report), Januaiy 30,1984. 
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National Information Infrastructure 

Investigation Group / Period of Activity 

National Information Infrastructure (Nil) Task Force 

August 2,1993-March 18,1997 

Issue Background 

At the August 2, 1993, lES meeting, the Plans 
Working Group (subsequentiy reestabiished as the 
Issues Group) recommended that a task force be 
established to address NS/EP telecommunications 
issues related to the evolution of the U.S. information 
infrastructure. The lES established an Nil Task Force 
to provide a series of reporfs with recommendations 
to the President. The task force’s charge was fo: 

► Idenfify, in collaborafion with Government, 
potential dual-use applications of fhe Nil and 
recommend Government actions; 

► Identify potenfial NS/EP implicafions of the Nil 
and recommend Government actions; 

► As a minimum, address items identified by 
the Director, OSTP at NSTAC XV (for example, 
security, resiliency, interoperability, standards, 
and spectrum); 

► Advise Government on technical and 
other considerations that will accelerate 
commercialization of a nafionwide high speed 
network available to NS/EP users; and 

► As a minimum, address architectural, policy, 
and regulatory issues, along with those 
research and development focus areas, 
pilot/demonstrafion projects, and civil/military 
telecommunications issues identified by OSTP 
and the National Economic Council. 

The task force relied on The National Information 
Infrastructure: An Agenda for Action, released by the 
administration on September 15, 1993, as a guide 
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for ifs work. This document called for the NSTAC 
to continue to offer advice fo the President on 
NS/EP telecommunications issues, work with the 
Federal Communications Commission’s Network 
Reliability Council (subsequently renamed the 
Network Reliability and Interoperability Council) 
and complement the work of the U.S. Advisory 
Council on the Nil. To better focus on its charge 
and coordinate with the Information Infrastructure 
Task Force and its committees, the Nil Task Force 
established three subgroups: the Policy Subgroup, 
the Applications Subgroup, and the Future 
Commercial Systems and Architecture Subgroup. 

The Policy Subgroup’s final report. Approach 
to Security and Privacy on the Nil, summarized the 
findings of the subgroup in network security. It 
made preliminary recommendations on ways to 
ensure that expansion and enhancement of the 
information infrastructure would be compatible 
with telecommunications security concerns. 

The Applications Subgroup assessed Nil 
applications that the Government was developing. 

In doing so, the subgroup developed criteria to 
select applications for increased emphasis. The 
subgroup made a number of recommendafions 
relafed fo developing dual-use applications. 

Additionally, the subgroup established an Emergency 
Health Care Information Focus Group to address 
health-care-specific issues for the Nil. The subgroup 
chose this application area as a model for examining 
importanf information infrastructure application 
issues, such as interoperability, privacy, and security. 

The final reporf of the Future Commercial Systems 
and Architecture Subgroup addressed the 
architectural principles and trends and NS/EP 
performance issues of fhe currenf and fufure Nil. If 
examined the Nil from fhe perspective of three major 
components: the public switched network, broadcast 
networks, and the Internet. 

Additionally, the Issues Group addressed the 
information infrastructure issue, working with the 
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OSTP to develop plans for an Nil Symposium at the 
Naval War College (NWC), Newport, Rhode Island, 
October 17 - 19, 1994. The Issues Group planned 
the symposium with the OSTP in response to an 
NWC invitation to the NSTAC to participate in a 
communications-focused game designed to address 
the Nil. The NWC produced a non-attribution report 
for distribution to all participants, and it is available to 
any interested parties upon request. 

History of NSTAC Actions and Recommendations 

The task force presented its interim report at 
the NSTAC XVI Meeting on March 2, 1994. The 
report provides the background on the task force’s 
establishment, its activities and future direction, and 
a summary that includes a proposed statement for 
the NSTACXVI Executive Report. The statement reiterates 
the task force’s commitment to assisting the President 
in ensuring it satisfies NS/EP requirements on the 
Nil. The NSTAC approved both the report and the 
proposed statement for forwarding to the President. 

The task force presented an Nil Task Force Status 
Report at NSTAC XVII on January 12, 1995. The 
report discussed the work of the task force’s three 
subgroups—the Policy Subgroup, the Applications 
Subgroup, and the Future Commercial Systems 
and Architecture Subgroup. The status report also 
addressed the 12 recommendations culled from the 
individual subgroup reports. 

The task force presented its third report to NSTAC 
XVI11 on February 28, 1996. The report included 
analysis and recommendations regarding three 
NS/EP issues: 1) the need for an Nil Security Center 
of Excellence (SCOE), 2) the emerging Gil, and 
3) Emergency Plealth Care Information. The NSTAC 
approved forwarding recommendations to the 
President regarding the latter two issues. 

Following NSTAC XVIII, the lES charged the task 
force to further investigate the advisability of 
establishing a SCOE, henceforth referred to as the 
Information Systems Security Board (ISSB). The 
task force conceptualized the ISSB as a private 
sector entity that would promote information systems 


security principles and standards to improve the 
reliability and trustworthiness of information products 
and services. The task force developed the ISSB 
Concept Paper, which outlined the functions and 
processes of the ISSB and served as the centerpiece 
for an outreach effort undertaken to ascertain the 
viability of the ISSB model. After contacting more 
than 100 major information technology companies, 
industry associations, Government agencies, and 
major information technology users, the Nil Task 
Force determined that there was broad support for 
the ISSB concept and that industry should take the 
lead in its formation. 

The task force presented its fourth and final report at 
NSTAC XIX on March 18, 1997. The report focused 
on the ISSB initiative and the NS/EP implications of 
the Gil. The NSTAC recommended the President 
endorse the private sector ISSB initiative. Lastly, the 
NSTAC approved a recommendation to sunset the 
Nil Task Force. 

Actions Resulting from NSTAC Recommendations 

The Information Technology Industry Council (ITIC) 
sponsored an effort to explore formation of the 
ISSB; the ITIC hosted the first meeting of this group 
on January 21, 1997. Following the meeting, the 
Information Security Exploratory Committee (ISEC), a 
consortium of interested stakeholders, met regularly 
to discuss the possibility of operationalizing the ISSB 
concept. The ISEC issued its report in January 1998 
in which it recommended that, although it supported 
the concept of the ISSB, studies revealed that 
establishment of such a board would be duplicative 
of private endeavors. 

At the same time, however, the ISSB concept 
influenced the Clinton Administration’s policy 
on implementing Presidential Decision Directive 
63, Critical Infrastructure Protection. Specifically, in 
an approach consistent with the NSTAC’s ISSB 
recommendation, the Administration’s Critical 
Infrastructure Assurance Office underscored the 
value of promoting industry standards and best 
practices to improve infrastructure assurance. 
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Reports Issued 

Nil Task Force Interim Report, February 1994. 
Nil Task Force Report, January 1995. 

Nil Task Force Report, February 1996. 

Nil Task Force Report, March 1997. 
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National Research Council Report 

Investigation Group / Period of Activity 

National Research Council (NRG) Report Task Force 

August 18,1989 - March 29,1990 

Issue Background 

In June 1989, the NSTAC noted that the NRC report, 
Growing Vulnerability of the Public Switched Networks (PSN): 
Implications for National Security Emergency Preparedness, 
differed from Telecommunications Systems 
Survivability Task Force findings. The NSTAC, 
therefore, charged the lES with examining those 
differences and reporting back in early 1990. In 
response, the lES formed the NRC Report Task Force 
and issued the following charges: 

► If it agreed with the NRC report, address what 
actions should be taken by industry to assist 
the Government in implementing the NRC’s 
recommendations; 

► If it did not agree, give the reasons why and the 
factors bearing on the differing perspectives of the 
lES and the NRC; and 

► Comment on the report's implications for 
interoperability. 

The task force issued its final report in March 1990. 

History of NSTAC Actions and Recommendations 

In March 1990, the NSTAC approved the findings of 
the NRC Report Task Force. Contrary to the NRC’s 
findings, the task force concluded the PSN was 
growing more survivable. This survivability stems 
from the increased network diversity provided by the 
existence of three major interexchange carriers, the 
increased user demand for network service availability, 
the deployment of robust network architectures, and 
the incorporation of advanced transmission, switching, 
and signaling technologies. The task force also noted 
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that current technologies and competitive trends were 
enhancing network robustness. 

Actions Resulting from NSTAC Recommendations 

The NRC Report Task Force agreed with some of the 
recommendations of the NRC report and believed 
that the issue of growing vulnerabilities of the PSN 
needed to be further addressed. Therefore, the lES 
established the Network Security Task Force. 

In 1991, the NRC report attracted considerable 
attention in Congress and at the FCC due to recurring 
outages of the PSN. The FCC established the Network 
Reliability Council on February 27, 1992, to make 
recommendations to the FCC on improving network 
reliability. The Network Reliability Council sponsored 
a symposium from June 10-11, 1993, in Washington, 
DC, on industry’s best practices for avoiding and 
minimizing the risk and impact of future telephone 
network outages. 

Report Issued 

NRC Report Task Force Final Report, March 1990. 
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National Telecommunications 
Management Structure 

Investigation Group / Period of Activity 

National Telecommunications Management Structure 
(NTMS) Task Force 

August 19,1986-June 8,1989 

Issue Background 

On May 22, 1986, the NSTAC concurred with the 
Government that there was a need for a survivable 
and endurable management structure to support 
NS/EP telecommunications requirements, and agreed 
that industry and Government should work jointly to 
develop such a capability. As a result, the NSTAC 
established the NTMS Task Force in August 1986 
and charged it with assisting in developing an NTMS 
implementation plan. 

History of NSTAC Actions and Recommendations 

On November 6, 1987, the NSTAC forwarded to 
the President its recommendation to approve the 
NTMS Implementation Concept The Executive 
Office of the President approved the concept on 
March 25, 1988. The NCS, opened the NTMS 
Program Office on June 17, 1988. During the week 
of July 12-15, 1988, the NCS conducted the NTMS 
trial exercise to determine the feasibility of the 
NTMS concept and funding requirements. The NCS 
successfully tested the National Telecommunications 
Coordinating Network concept September 27-29, 
1988. The NCS completed the NTMS program plan 
in March 1989, and it is updated periodically. 

The NSTAC disbanded the NTMS Task Force on 
June 8, 1989. 

Actions Resulting from NSTAC Recommendations 

Through the NCC, industry provides advice and 
assistance in pursuit of NTMS operational capability. 

The NCS established the COR NTMS Subcommittee 
to assist in achieving NTMS initial operational 
capability. The NTMS program became operational 
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with the implementation of the northeast region in 
October 1990. In September 1991, the activation 
of the southwest and northwest regions provided 
additional capability. The subcommittee also 
completed NTMS regional validations in Chicago, 
Illinois, during November 1992; in Atlanta, Georgia, 
during February 1993; and in Denver, Colorado, 
during April 1993. 

Report Issued 

NTMS Implementation Concept (Final), November 1987. 
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Network Convergence 

Investigation Group / Period of Activity 

Information Technology Progress Impact Task Force (ITPITF) 

September 1999 - June 2000 

Convergence Task Force (CTF) 

June 2000-June 2001 

Network Security Vulnerability Assessments Task Force (NS/VATF) 

NS/VATF: June 2001 - March 2002 


Issue Background 

Telecommunications carriers are implementing 
cost-effective packet networks to remain 
competitive in the evolving telecommunications 
marketplace and to support wide-scale delivery of 
diverse, advanced broadband services. However, 
because of their large investments in circuit 
switched network infrastructure, carriers are 
initially leveraging the best of both infrastructures, 
resulting in a period of network convergence 
during the transition to the next generation network 
(NGN). In this evolving network environment, the 
NSTAC recognizes that industry and Government 
must strive to identify and remedy associated 
network vulnerabilities to ensure sustained 
critical communications capabilities of the NS/EP 
community. Accordingly, the NSTAC established 
task forces to analyze various infrastructure, 
security, and operational vulnerabilities stemming 
from network convergence and to provide 
recommendations to mitigate the vulnerabilities. 

History of NSTAC Actions and Recommendations 

Following NSTAC XXII in June 1999, the lES created 
the ITPITF to examine the potential implications of 
Internet Protocol (IP) network and public switched 
network (PSN) convergence on existing NS/EP 
services {e.g., GETS and TSP) and to prepare for a 
Research and Development Exchange Workshop 
(RDX) focusing on network convergence issues. 
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The ITPITF analyzed issues related to GETS 
functionality in IP networks. The ITPITF determined 
that because IP networks do not have network 
intelligence features analogous to Signaling System 
7 (SS7), IP networks may not support activation of 
GETS access and transport control and features. 
Furthermore, without quality of service (QoS) features 
to enable priority handling and transport of traffic in 
IP networks, GETS calls may encounter new blocking 
sources and be subject to poor completion rates 
during overload conditions. The ITPITF concluded 
that as the NGN evolves, telecommunications 
carriers’ SS7 networks will become less discrete and 
more dependent on IP technology and interfaces. 
Therefore, it will be necessary to consider the 
security, reliability, and availability of the NGN control 
space related to the provision and maintenance of 
NS/EP service capabilities. 

In addition, the ITPITF analyzed potential 
implications of convergence on TSP services. The 
ITPITF concurred with the oversight committee 
that TSP services remained relevant in converged 
networks, as TSP assignments could still be 
applied to identifiable segments of the PSN. 
However, because TSP applies only to circuit 
switched networks, a new program may be needed 
to support priority restoration and provisioning in 
end-to-end packet networks. 

The ITPITF also examined evolving network 
technologies and capabilities that could support 
NS/EP functional requirements in both converged 
networks and the NGN. The ITPITF concluded 
that QoS and other new NGN capabilities would 
require some enhancement to best satisfy specific 
NS/EP requirements. 

Based on the ITPITF’s May 2000 report to NSTAC 
XXIII, the NSTAC recommended that the President, 
in accordance with responsibilities and existing 
mechanisms established by E.Q. 12472, Assignment of 
National Security and Emergency Preparedness Telecommunications 
Functions, direct the appropriate departments and 
agencies, in coordination with industry, to: 
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► Promptly determine precise functional NS/EP 
requirements for convergence and the NGN; and 

► Ensure that relevant NS/EP functional 
requirements are conveyed to standards bodies 
and service providers during NGN standards 
development and implementation. 

Additionally, the ITPITE recommended that the 
NSTAC XXIV work plan include an examination of 
the potential NS/EP implications related to possible 
security and reliability vulnerabilities of the control 
space in the NGN. 

On September 28-29, 2000, the President’s 
NSTAC co-sponsored its fourth RDX. The event was 
co-sponsored by the White House Office of Science 
and Technology Policy (OSTP) and conducted 
in conjunction with the Telecommunications and 
Information Security Workshop 2000 held at the 
University of Tulsa in Tulsa, Oklahoma. The purpose 
was to exchange ideas among representatives 
from industry. Government, and academia on 
the challenges posed by network convergence. 
Discussions of convergence issues at the workshop 
and the RDX led to the following conclusions: 

► There is a shorfage of qualified information 
technology (IT) professionals, particularly those 
with expertise in information assurance and/or 
computer security; 

► Developing a business case for security poses 
difficult challenges in the commercial sector, and 
there is a need to offset the high costs and high 
risks associated with R&D in security technology; 

► Given the complexity and interdependence 
introduced to networks by convergence and the 
proliferation of network providers and vendors, 
best practices, standards, and protection profiles 
that help to ensure secure interoperable solutions 
must be evenly applied across the NGN; and 

► There is a need to enhance R&D efforts to 
develop better testing and evaluation programs 


to reduce the vulnerabilities introduced by 
malicious software. 

From these conclusions, the participants at the RDX 
offered several recommendations for consideration 
by the Government and the NSTAC. These 
recommendations focus on improving network 
security in a converged and distributed environment. 
Specifically, the Government should: 

► Establish and continue to fund Government 
programs to encourage increasing the number of 
graduate and undergraduate students pursuing 
study in computer security disciplines; 

► Increase the funding and support to the National 
Security Agency and other Government agencies 
to facilitate the certification of additional 
Information Assurance (lA) Centers of Excellence 
fo train and educate the next generation of 
information technology security professionals; 

► Develop tax credits and other financial incentives 
to encourage industry to invest more capital in the 
research and development of security technologies; 

► Expand partnerships on critical infrastructure 
protection issues by encouraging more 
representatives from academia and State and 
local Governments to participate; and 

► Invest in R&D programs that encourage the 
development of best practices in NGN security, 
such as improved testing and evaluation, broadband 
protection profiles, and NGN security standards. 

To support the Government, the NSTAC should: 

► Consider the issues of best practices and 
standards in its report to NSTAC XXIV; 

► Consider the evolving standards of due care legal 
issues discussed at the R&D Exchange, including 
linked or third party liability and new privacy 
legislation and regulations such as the Health 
Insurance Portability and Accountability Act; and 
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► Conduct another RDX in partnership with one or 
more of the IA Centers of Excellence to discuss 
the difficulties in and strategies for both increasing 
the number of qualified IT security professionals 
and enhancing the academic curricula to meet the 
security challenges of fhe NGN. 

Beginning in September 2000, the Convergence 
Task Force (CTF) analyzed issues related to the 
potential security and reliability vulnerabilities of 
converged networks. Based on briefings received 
from industry and Government representatives, the 
CTF concluded that the public switched telephone 
network (PSTN) Is becomingly increasingly 
vulnerable as a result of its convergence with packet 
networks. Of particular concern to the CTF was the 
interoperation of the intelligent network of the PSTN 
with IP networks i//aexisting gateways. The CTF 
noted that malicious attacks on these gateways could 
impact overall network availability and reliability. 
Members suggested that possible remedies for 
these vulnerabilities include signaling firewalls 
implemented at network gateways and embedded 
security capabilities defined through standards. The 
CTF determined that additional analysis of these 
security vulnerabilities is required to gain further 
understanding of the possible consequences of 
the evolving NGN. Such an analysis should Include 
examination of fhe convergence of wireless data 
networks with the PSTN. 

Furthermore, it was agreed that the NGN must 
offer the NS/EP community quality of service, 
reliability, protection, and restoration features 
analogous to those of the PSTN. To achieve this, 
the CTF suggested that Government foster strong 
working relationships with NGN carriers and work 
to specify security requirements in packet network 
procurements in an effort to attain network reliability 
commensurate with that of the PSTN. 

In response to concerns expressed by prominent 
Government officials, the CTF also examined Issues 
of possible single points of failure in converged 
networks and associated possibilities of widespread 
network disruptions. Through examination of related 
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past NSTAC reports and participation in a National 
Coordinating Center for Telecommunications 
single point of failure exercise, the CTF members 
determined that a scenario could not be envisioned, 
even in the converged network environment, 
in which a single point of failure could cause 
widespread nefwork disruption. Members found 
if more likely that any single points of nefwork 
failure would have only local or “last mile” impacts. 
However, the CTF concluded that unforeseen points 
of failure precluded definitive assertions regarding 
the implausibility of a national level network failure. 
The CTF also found thaf converged network 
vulnerabilities and possible points of failure could 
impact service availability and reliability essential 
to NS/EP operations rather than creating network 
component failures. Members suggesfed sharing 
defailed network data among industry. Government, 
and academia was needed to further understand 
converging networks and achieve more accurate 
network modeling and simulation techniques to 
analyze vulnerabilities and their impacts. 

The CTF also examined the ongoing standards 
development efforts supporting NS/EP priority 
requirements in the converged network. Group 
members concluded that, as the NGN evolves 
to offer more advanced broadband services, fhe 
Government must remain actively involved in the 
relevant standards bodies' activities to help define 
and ensure the consideration of NS/EP requirements 
in the IP environment. The CTF further encouraged 
the Government to remain actively involved in 
working group activities related to NS/EP issues 
including the Internet Engineering Task Force and 
the International Telecommunications Union. 

Based on the CTF’s June 2001 report to NSTAC 
XXIV, the NSTAC recommended that the President 
direct the appropriate departments and agencies, in 
coordination with industry, to: 

► Specify nefwork securify, service level, and 
assurance requiremenfs in contracts to help 
ensure reliability and availability of NS/EP 
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communications during network convergence and 
in the developing NGN; 

► Ensure that standards bodies consider NS/EP 
communications functional requirements during 
their work addressing network convergence 
issues, including security of PSTN-IP network 
SS7 control traffic and development of packet 
network priority services; 

► Plan and participate in additional exercises 
examining possible vulnerabilities in the 
emerging public network (PN) and subsequent 
NS/EP implications on a national and 
international basis; and 

► Utilize the Telecom-ISAC to facilitate the process of 
sharing network data and vulnerabilities to develop 
suitable mitigation strategies to reduce risks. 

Additionally, the GTE recommended that the NSTAC 
XXV work plan include the following tasks: 

► Examine the NS/EP security and reliability 
implications of the convergence of wireless 
data networks with the PSTN and traditional 
wireless networks; 

► Support the efforts of the Government Subgroup 
on Convergence as requested by the Government 
in accordance with NSTAC’s charter; and 

► Eurther examine converged network control 
space-related vulnerabilities, including those 
of signaling and media gafeways, and analyze 
possible NS/EP Impllcafions. 

Actions Resulting from NSTAC Recommendations 

Based on NSTAC recommendations, the NCS is 
actively participating in various standards bodies 
to ensure consideration of NS/EP functional 
requirements during convergence and in the 
NGN. The NCS is contributing to activities of 
the European Telecommunications Standards 
Institute, Telecommunications and Internet Protocol 
Plarmonization over Networks (ETSI TIPPION) group. 


ETSI TIPPION is examining several security issues 
related to convergence, including identification and 
authentication procedures for emergency calls, 
and Issues related to cyber attacks and malicious 
Intrusion into networks. 

The NCS is also active in International 
Telecommunication Union Standardization Sector 
efforts regarding recommendation E.106, Description 
of the International Emergency Preference Scheme 
(lEPS). lEPS recognizes the requirement for priority 
communications among Government, civil, and 
other essential users of public felecommunications 
services in crisis situations. lEPS, which is similar to 
GETS, would give authorized users priority access 
to and transport of NS/EP-related calls on an 
International basis within the PSTN and integrated 
services digital network infrastructures. 

Citing findings of the ITPITE, on March 9, 2001, 
the National Coordinator for Security, Infrastructure 
Protection, and Counter-terrorism established, in 
conjunction with OSTP, an interagency Convergence 
subgroup under the Counter Terrorism and 
National Preparedness Information Infrastructure 
Protection Assurance Group. The purpose of this 
Convergence Working Group (CWG) was to address 
issues associated with the convergence of the voice 
and data networks and the implications of this 
convergence on NS/EP telecommunications services. 
The associated policy, legal, security, and technical 
issues were previously identified in a Report of the 
CTE, dated December 29, 2000. The CWG issued its 
final report on Eebruary 14, 2002. 

Following NSTAC XXIV in May 2001, the lES formed 
the Network Security/Vulnerability Assessments Task 
Force (NS/VATF) and charged the group to address 
public network policy and technical issues related to: 

► Network disruptions, particularly distributed 
denial of service (DDoS) attacks; 

► Security and vulnerability of the converged 
network control space, including wireless, 
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network simulation and testing, standards, and 
consequence management issues; and 

► Needed countermeasures {e.g., functional 
requirements) to address the issues above. 

The NS/VATF noted that the September 11, 

2001, terrorist attacks on the World Trade Center 
and the Pentagon have renewed concerns 
regarding physical threats to the PN. While the 
telecommunications infrastructure had not been a 
direct target of terrorism, it could be in the future. 
Therefore, fhe NS/VATF concluded that Federal, 
State, and local Government assistance related 
to preventing, mitigating, and responding to such 
an occurrence should be coordinated through the 
Telecom-ISAC. In addition to the enduring physical 
threat to the Nation’s networks, the NS/VATF 
concluded that cyber attacks present a growing 
threat to the security of U.S. information systems 
and, consequently, to the critical communications 
of the NS/EP community. As cyber network 
attack techniques Increase in sophistication and 
intruders continue using DDoS techniques to exploit 
vulnerabilities, cyber attacks will likely cause greater 
collateral impacts to NS/EP communications. 
Because of this threat environment, the NS/VATE 
concluded that industry and Government should 
continue participating in ISACs to develop and 
implement unified and cenfralized capabilities to 
respond to attacks as they are occurring. 

The NS/VATE also concluded that additional steps 
are necessary to enhance the security of the control 
space of the evolving PN. As network convergence 
continues, malicious attacks focusing on fhe network 
control space are increasingly feasible; therefore, 
industry and Government cooperation is necessary to 
address control space vulnerabilities and implement 
remedial tools. The NS/VATE also encouraged 
industry and Government support of the NSIE efforts 
to develop a cross-industry security posture that 
could help provide a foundation for protecfing the 
control space of the emerging PN. 
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The NS/VATE also expressed concern about security 
issues affecting NS/EP communications transiting 
wireless networks and technologies, including 
the security of the interoperation of wireless and 
wireline networks—and, more specifically, activities 
addressing the wireless access protocol. 

The task force also concluded thaf Government 
should deploy wireless local area networks with 
higher levels of security and consider policies that 
would reduce the risks of using personal area 
nefwork devices. 

On the basis of its analysis, the NS/VATE stated 
that some of fhe best strategies for counfering 
vulnerabilities of the critical telecommunications 
Infrastructure involved: 

► Increasing Government participation in 
standards bodies, and developing a coordinated 
Government-wide approach to standards 
development; 

► Specifying security standards in contracts and 
purchase orders. This process would result in 
more commercial off-the-shelf products and 
services, which the Government can then procure 
at reduced cost; and 

► Increasing stakeholder awareness of cyber 
vulnerabilities and mitigation strategies, including 
strong cyber security and response plans. 

The NS/VATE concluded that the PN and Its services 
supporting NS/EP users would continue to be at 
risk from increasingly technologically sophisticated, 
well-coordinated threat sources. Therefore, industry 
and Government must continue to work together 
to devise countermeasures and strategies to help 
mitigate the impacts of physical and cyber atfacks on 
fhe PN and other critical infrastructures. 

Based on the NS/VATF’s March 2002 report to 
NSTAC XXV, the NSTAC recommended that the 
President direct the appropriate departments and 
agencies, in coordination with industry to: 
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► Coordinate and prioritize through the Telecom-ISAC, 
Government assistance to industry to protect the 
Nation’s critical communications assets and to 
mitigate the effects of an attack as it is occurring; 

► Encourage and adequately support the 
development and adoption of baseline 
standards and technologies including version 6, 
Internet Protocol Security, and the Emergency 
Telecommunications Service scheme, to help 
bolster core security and reliability of the NGN; 

► Support the NSIEs’ efforts to develop a 
cross-industry security posture that could help 
provide a foundation for containing the control 
space of the emerging public network; 

► Work with standards bodies to ensure 
consideration of NS/EP communications 
functional requirements while addressing the 
security of the interoperation of wireless and 
wireline networks, and more specifically, activities 
addressing wireless access protocol; 

► Ensure that all wireless local area networks used 
by the Government meet the highest level of 
security standards available, with priority given to 
those supporting NS/EP missions; and 

► Develop policies and procedures to support 
the use of personal area network devices while 
reducing their risk of compromise. 

Eollowingthe NSTAC XXVII Meeting held on 
May 19, 2004, the NSTAC created the Next 
Generation Networks Task Eorce (NGNTE), to 
conduct an examination of NS/EP requirements 
and emerging threats on the NGN. (See the Next 
Generation Networks section in the Active Issues 
section of this NSTAC Issue Review.) 


Reports Issued 

Information Technology Progress Impact Task Force Report 
on Convergence, May 2000. 

Research and Development Exchange Proceedings: Transparent 
Security in a Converged Network Environment, September 2000. 

Convergence Task Eorce Report, June 2001. 

Network Security Vulnerability Assessments Task Eorce Report, 
March 2002. 
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Network Security 

Investigation Group / Period of Activity 

Network Security Task Force (NSTF) 

February 21,1990—August 26,1992 

Network Security Information Exchange (NSIE) 

June 25,2001—Present 

Network Security Standards Oversight Group (NSSOG) 

August 26,1992—January 12,1995 

Network Security Steering Committee (NSSC) 

August 26,1992—December 1994 

Network Security Group (NSG) 

December 1994—April 22,1997 

Network Group (NG) 

April 22,1997—September 23,1999 

Embedded Interoperahle Security Issue Scoping Group 
(EISISG) 

June 1999—November 1999 

Protecting Systems Task Force (PSTF) 

September 23,1999—May 2000 

Internet Security/Architecture Task Force (IS/ATF) 

April 2002—April 2003 

Operations, Administration, Maintenance, and Provisioning 
(OAM&P) Standard Working Group 

February 2003—A ugust 2003 

Issue Background 

Network security issues lie at the core of the 
President’s National Security Telecommunications 
Advisory Committee’s (NSTAC) work on behaif of 
the President. The NSTAC initiated in-depth review 
of network security issues in February 1990 when 
the Committee’s Industry Executive Subcommittee 
(lES) established the NSTF to address the Nationai 
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Security Council’s concern about the vulnerability 
of the Nation’s telecommunications networks to 
intentional software disruptions or manipulations 
that could threaten national security and emergency 
preparedness (NS/EP) communications. Fiaving 
completed its original task, the lES reestablished the 
NSTF at the December 1990 NSTAC meeting and 
charged it to work closely with, and in support of, 
the Government Network Security Subgroup (GNSS). 
In June 1991, the NSTF established the NSTAC 
NSIE. The task force submitted its final report and 
recommendations to the NSTAC on July 17, 1992. 

On August 26, 1992, the lES deactivated the NSTE 
and established the NSSC and the NSSOG. The 
NSSOG completed its task and disbanded in January 
1995. The lES subsequently renamed the NSSC 
the NSG in accordance with the December 1994 
lES Guidelines. In April 1997, the lES realigned its 
groups and renamed the NSG the NG. In September 
1999, the lES restructured and created the PSTE to 
accomplish the tasking formerly assigned to the NG. 

During the NSTAC XXVI cycle, the lES created the 
IS/ATF to develop policy recommendations with 
respect to the vulnerabilities in pervasive software 
and protocols critical to the operation of the Internet. 

In 2002, the NSTAC’s NSIE and the Government 
NSIE established the Security Requirements 
Working Group (SRWG) to examine the security 
requirements for controlling access to the public 
switched network, in particular with respect to 
the emerging next generation network. Members 
of the SRWG, representing a cross-section of 
telecommunications carriers and vendors, developed 
an initial list of security requirements that would 
allow vendors, Government departments and 
agencies, and service providers to implement a 
secure telecommunications network management 
infrastructure. The SRWG developed this initial list 
of security requirements as a consensus document 
and submitted it as a contribution to the Alliance 
for Telecommunications Industry Solutions (ATIS) 
Committee Tl-Telecommunications, Working 
Group T1M1.5 OAM&P Architecture, Interface and 
Protocols for consideration as a standard. 
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Representatives from T1M1.5, the NSTAC NSIE, the 
Government NSIE, and TlMl liaison organizations 
further refined the initial document and developed 
the standard, entitled Operations, Administration, 
Maintenance, and Provisioning Security Requirements for the 
Pubiic Tetecommunications Network: A Baseiine of Security 
Requirements for the Management Ptane. Committee T1 
approved the standard (Tl.276-2003) in July 2003. 

During the NSTAC XXVII cycle, the lES created 
the OAM&P Standard Working Group to further 
examine the standard and develop conclusions and 
recommendations for action. 

History of NSTAC Actions and Recommendations 

On July 17, 1992, the NSTAC approved the Network 
Security Task Force Finai Report. The report recommended 
that the President: 

► Publicly support the NSTAC network security 
initiative; and 

► Establish a Government focal point for 
coordination on network security standards. 

The NSTAC also endorsed both the NSSOG and 
a strong network security Information exchange 
among industry companies. The NSTAC formed 
its NSIE in 1991, paralleling a GNSS effort to 
create a Government NSIE. The joint meetings 
of the NSTAC and Government NSIEs remain a 
unique industry and Government forum where 
representafives exchange informafion on nefwork 
threats and vulnerabilities in a trusted, nondisclosure 
environment. 

The lES established the NSSOG and the NSSC in 
response to NSTAC XIV charges to continue network 
security activities. The lES established the NSSC 
as a permanent lES working group with oversight 
responsibility for nefwork securify activities. 

On May 27, 1993, the NSSC recommended that the 
President: 
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► Correct the legislative deficiencies affecting the 
capability to gather evidence about computer 
crimes and to prosecute and convict computer 
criminals who target computers that support the 
national telecommunications infrastructure. 

In Eebruary 1994, the Government and NSTAC 
NSIEs sponsored a Network Security Symposium. 
These groups designed the symposium to 
inform attendees of the potential threats to and 
vulnerabilities of the public switched network (PSN) 
from computer intruders. Subject matter experts 
from industry. Government, and law enforcement 
presented information. 

At the March 2, 1994, NSTAC XVI meeting, the 
NSSC updated its assessment of the risk to the PSN 
and noted its plans to strengthen the NSTAC NSIE 
and expand its membership. 

On June 28, 1994, the Government and NSTAC 
NSIEs sponsored a network firewalls workshop. 

The workshop provided an overview of firewall 
fechnologies, addressed sfrategies for mitigafing 
vulnerabilities, discussed firewall uses and 
applications, and reviewed case histories. 

In October 1994, the NSSOG released a technical 
report focusing on nefwork securify sfandards issues 
for the PSN. In Its report, the NSSOG categorized 
12 recommendations on policy, procedural, 
and technical issues important to promoting 
interoperability, mitigating current or future threat 
scenarios, implementing realistic solutions, and/or 
addressing a range of technologies or architectures. 

At the January 12, 1995, NSTAC XVII meeting, 
the NSTAC approved the NSSOG report and 
recommended that the President: 

► Task the National Institute of Standards and 
Technology (NIST) and other Government 
organizations to support industry in the 
development of sfandards recommended in the 
NSSOG report. 
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At the February 28, 1996, NSTAC XVIII meeting, the 
NSTAC approved the NSG’s findings with respect 
to determining NSTAC’s potential contributions to 
developing a middle-ground security technology 
solution. The NSTAC also presented the findings of 
a report entitled. An Assessment of the Risk to the Security 
of PubiicNetworks, which was co-authored by the 
Government and NSTAC NSIEs. 

On September 11, 1996, the Government and 
NSTAC NSIEs sponsored a symposium on securing 
data networks. This event continued successful 
efforts by the NSIEs to share lessons learned about 
network security with a broader audience through 
workshops and analytical reports. 

Also in September 1996, the NSG sponsored the 
Network Security Research and Development (R&D) 
Exchange. The event’s purpose was to analyze R&D 
activities ongoing in both the public and private 
sectors and to address issues of authentication, 
intrusion detection, and access control from the 
capabilities management perspective. In November 
1996, the NSG organized the Eorward-Looking 
Analysis Panel to consider the impact of the 
Telecommunications Act of 1996 on network security 
and NS/EP telecommunications services. The panel 
addressed issues such as carrier interconnection, 
collocation, and open network architecture. 

The Federal Communications Commission’s 
(FCC) Network Reliability and Interoperability 
Council (NRIC) considered the panel’s input and 
subsequently included it in the NRIC’s final report. 

At the March 18, 1997, NSTAC XIX meeting, the 
NSG reported on its work to address the impact 
of the changing regulatory and technological 
environment on NS/EP telecommunications services. 
The NSG also reviewed its recent activities in the 
areas of R&D, intrusion detection, and forward- 
looking network control security analysis. At the 
meeting, the NSG outlined the efforts of the newly 
established Intrusion Detection Subgroup (IDSG) and 
its charge to explore a more cooperative approach to 
developing enhanced intrusion detection tools. The 
NSG concluded by addressing the activities of the 
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NSIEs and noted that the NSTAC NSIE expanded its 
membership from nine to twenty. 

Eollowing NSTAC XIX, the NG’s IDSG assessed 
network intrusion detection R&D activities to 
determine whether NS/EP considerations required 
additional efforts. Working with industry groups, 
the Defense Advanced Research Projects Agency 
(DARPA) and other Government groups, the IDSG 
identified the current state of intrusion detection 
research. The IDSG subsequently provided a 
report to NSTAC XX in December 1997 detailing its 
findings and recommendations for the President to 
consider in promoting the R&D of intrusion detection 
technologies. The NSTAC accepted and approved 
the report and recommended that the President: 

► Promulgate a national technology policy to 
address intrusion detection; 

► Establish an interagency working group for 
intrusion detection; 

► Increase R&D funding for intrusion detection 
for network control systems vital to continued 
operation of critical infrastructures; and 

► Encourage cooperative development programs. 

The NG established another subgroup following 
NSTAC XIX to respond to a request by Dr. John 
Gibbons, then Assistant to the President for 
Science and Technology. Dr. Gibbons asked 
NSTAC to determine the likelihood of a widespread 
telecommunications outage, identify industry plans in 
place for intercarrier coordination to respond to such 
an outage, and describe how telecommunications 
service providers and the Government would 
cooperate to assure the President that restoration 
priorities would meet the national interest. The 
NG established the Widespread Outage Subgroup 
(WOS) to focus on these issues and provided a 
report to NSTAC XX reflecting its findings. The WOS 
determined that, given the limited precedent for 
telecommunications outages of such magnitude, 
there was a low probability of a widespread. 
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sustained outage of public telecommunications 
service. In December 1997, the NSTAC approved the 
WOS report and recommended that the President: 

► Direct the appropriate Federal departments 
and/or agencies to work with industry to improve 
intercarrier coordination plans and procedures; 

► Encourage the FCC to maintain a Defense 
Commissioner af all times to help industry and 
Government overcome legal and regulatory 
impediments to a rapid and orderly restoration of 
service during a widespread felecommunications 
outage; 

► Task the appropriate Federal departments and 
agencies to work with industry to advance the 
state-of-the-art for soffware integrity; and 

► Direct the expansion of Government R&D efforts 
to address the most significant vulnerabilities 

of new and evolving telecommunicafions 
technologies and services. 

Following NSTAC XX, the NG examined the 
readiness of the telecommunications industry to 
ensure continuity of service through the millennium 
change, focusing on NS/EP and fhe national 
telecommunications infrastructure. The NG 
surveyed telecommunications service providers, 
equipment vendors, system integrators, industry 
forums addressing fhe Year 2000 (Y2K) problem, 
and vendors providing Y2K solufions. The NG 
concluded fhat significant efforts were underway in 
both industry and Government to eradicate the Y2K 
problem within the Nation’s telecommunications 
infrastructure. Flowever, given the extent and 
complexity of the Y2K software augmentation, 
there were no guarantees that Y2K measures 
would anticipate, and/or prevent, every problem. In 
September 1998, the NSTAC approved the NG’s Year 
2000 Problem Status Report and recommended that the 
President: 

► Direct appropriate departments and agencies to 
develop contingency plans to: 
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► Respond to Y2K-induced service impairments 
of the Government’s NS/EP customer premises 
equipment (CPE), functions, and applications 

► Fulfill mission-critical NS/EP responsibilities in the 
event of Y2K induced PN service impairmenfs 

► Direct his Y2K focal point to ensure the 
coordination of fhe Governmenf’s requests 
for Y2K readiness information from the 
telecommunications industry 

Following NSTAC XXI, the NG continued the tasking 
from the NSTAC XX meeting to examine how NS/EP 
operations might be affected by a severe disruption 
of Internef service. In conjunction with the gap 
analysis effort by the Office of the Manager, National 
Communications System (OMNCS), NG members 
provided their individual perspectives on the Public 
Network (PN) Alternatives Analysis Report developed by 
the OMNCS. During this cycle, the NG continued 
to oversee the NSTAC NSIE and worked toward 
facilitating the exchange of network security R&D 
information between industry and Government. 

The R&D effort subsequently resulted in an NG- 
sponsored R&D Exchange in October 1998, 
held in collaboration with activities sponsored by 
Purdue University’s Computer Operations, Audit, 
and Security Technology (COAST) Laboratory 
and the Institute of Electrical and Electronics 
Engineers (IEEE). The exchange focused on two 
themes. The first theme examined how industry 
and Government can better collaborate on R&D. 

The second examined the growing convergence 
of telecommunications and the Internet. The 
attendees overwhelmingly agreed on the need to 
identify potential centers of excellence in industry. 
Government, and academia and provide them 
with appropriate long-term funding to promote the 
development of compufer and network security 
professionals, disciplines, and programs. Equally 
importanf was fhe need fo esfablish large-scale 
testbeds to promote joint research, develop and 
verify metrics and evaluate security products, and 
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address other technical needs in network security 
and information assurance. 

The Government and NSTAC NSIEs completed an 
after-action report on the workshop, The Insider Threat 
to Information Systems: A Framework for Understanding and 
Managing the Insider Threat In Today's Business Environment 
The workshop was held in June 1998. The after- 
action report provided for sharing lessons learned in 
this vital area of insider threat that is affecting both 
industry and Government. In addition, the NSIEs 
completed their 1999 Assessment of the Risk to the Security 
of the Public Network. The NSIEs concluded that the 

1995 findings regarding the overall vulnerabilities 
of the PN were still valid. Old vulnerabilities were 
still being exploited even though fixes were readily 
available. Vulnerabilities in many of the PN’s 
diverse technologies (including. Signaling System 
7 [SS7], Intelligent Networks [IN], Asynchronous 
Transfer Mode [ATM], and Synchronous Optical 
Network [SONET]) remained unaddressed. The 
interconnectivity among technologies and networks 
had not merely persisted, but had become even 
greater than it was in 1995. Between 1995 and 
1999, three major factors exacerbated the overall 
vulnerability of the PN: the Telecommunications Act of 

1996 (Telecom Act), changing business practices, 
and the Y2K problem. 

In addition, the NSTAC NSIE revised its charter to 
bring it in line with how the NSIEs function. The 
NSIEs are primarily information sharing bodies in the 
area of network vulnerabilities and threat analysis. 

In June 1999, the NG completed its work on the 
Internet Report: An Examination of NS/EP Implications of 
Internet Technologies. The report addressed the following 
three objectives: 1) examine the extent to which 
NS/EP operations will depend on the Internet over 
the next 3 years; 2) identify vulnerabilities of network 
control elements associated with the Internet and 
their ability to cause a severe disruption of Internet 
service, applying lessons learned from NSTAC’s 
similar studies of the PSN; and 3) examine how 
Internet reliability, availability, and service priority 
issues apply to NS/EP operations. 
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The NG concluded that the NS/EP community’s 
direct dependence on the Internet for mission 
critical operations was modest. Departments and 
agencies with NS/EP responsibilities were using the 
Internet mostly for outreach, information sharing, 
and electronic mail. The NS/EP community was 
more inclined to depend on dedicated Transmission 
Control Protocol/Internet Protocol (TCP/IP) networks 
(also called intranets) for mission-critical NS/EP 
operations, at this time, because of significant 
security and reliability concerns associated with the 
Internet. In June 1999, the NSTAC approved the 
NG’s report and the following recommendations: 

► Recommend that the President, in accordance 
with responsibilities and existing mechanisms 
established by Executive Crder 12472, 

Assignment of National Security and Emergency 
Preparedness Telecommunications Eunctlons, direct the 
establishment of a permanent program to address 
NS/EP issues related to the Internet. The program 
should have the following objectives: 

• Work with the NS/EP community to 
increase understanding of evolving Internet 
dependencies 

• Work with key Internet organizations and 
standards bodies to increase awareness of 
NS/EP requirements 

• Interact with the appropriate Internet 
organizations and initiatives to Investigate, 
develop, and employ NS/EP-specific Internet 
priority services, such as end-to-end priority 
routing and transport 

• Examine the potential Impact of IP network- 
PSN convergence on PSN specific priority 
services 

► Recommend that the President direct the 
appropriate Government departments and 
agencies to use existing industry/Government 
partnership mechanisms to increase awareness 
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of NS/EP requirements within key Internet 
organizations and standards bodies 

In addition, the NSTAC directed the lES to examine 
the potentiai impact of IP network-PSN convergence 
on PSN-specific NS/EP priority services (including, 
Government Emergency Teiecommunications Service 
[GETS] and Telecommunications Service Priority 
[TSP]). 

Eollowingthe NSTAC XXV Meeting on March 13, 
2002, the lES again focused on network and Internet 
security issues. At the meeting, the Special Advisor 
to the President for Cyberspace Security discussed 
the serious threats posed by vulnerabilities within 
the Domain Name Servers and the Border Gateway 
Protocol. In response to these concerns, the NSTAC 
created the ISATE to develop recommendations 
to the President on how to identify and remediate 
vulnerabilities in pervasive software/protocols, define 
the “edge” elements of the Internet, and determine 
ways that the NSTAC could integrate its efforts to 
define and monitor significant critical infrastructures 
supporting the Internet with other industry activities. 

I n its First Steps in identifying and Remediating Vuinerabiiities 
in Pervasive Software/Protocois report, the ISATE analyzed 
five stages relevant to identifying and remediating 
vulnerabilities in pervasive software and protocols: 
prevention, detection, information sharing, analysis, 
and correction. In the area of prevention, the task 
force advocated aggressive public-private research 
and development activities and cited the need to 
develop adequate alert and warning systems to 
support the operations of information sharing and 
analysis centers. The task force also identified 
barriers to the effective detection of vulnerabilities, 
such as the myriad number of forums devoted to 
detection and the lack of standardization in reporting 
procedures. Next, the task force emphasized that 
significant barriers to information sharing exist, such 
as the Freedom of information Act (EOIA) and liability 
concerns, and advocated the creation of legislation 
that would ease the sharing of critical information. 
The ISATE also concluded that the analysis functions 
within industry that detect and publish vulnerabilities 


appear to be adequate, but the Government may 
find some benefit in better leveraging available 
synergies by consolidating Government-funded 
analysis centers where appropriate. Einally, the 
task force observed that while many organizations 
are successfully correcting and remediating 
vulnerabilities, they fail to utilize a streamlined 
method for expeditiously disseminating corrected 
information to the telecommunications and Internet 
service provider (ISP) communities. 

Based on the findings of the ISATE report, the 
NSTAC recommended that the President direct 
the appropriate departments and agencies, in 
coordination with industry, to: 

► Consolidate Government-funded watch center 
operations of agencies and departments 
dedicated to the detection and dissemination 
of information related to Internet vulnerabilities 
into one organization to create a more efficient 
and effective collaborative industry/Government 
information-sharing partnership; 

► Establish a lead organization within the 
Department of Homeland Security (DHS) to 
coordinate with industry a process for warning, 
notification, coordination, and remediation of 
widespread problems in a national emergency; 

► Recognize the need to involve all aspects of the 
Internet in the process of identifying significant 
vulnerabilities, including the web hosting, network 
access provider, backbone, and ISP communities; 

► Fund efforts related to identifying and mitigating 
vulnerabilities in the most critical protocols 

or software that key sectors of the Nation’s 
infrastructure rely upon; and 

► Promote and support legislation to address 
EOIA, antitrust, and liability concerns regarding 
information shared by industry for the purposes of 
critical infrastructure protection. 
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Additionally, the ISATF made other recommendations 
focused on developing a process for fhe Infernet 
communify, bofh privafe and public, fo share 
information within its component communities, and 
within the larger telecommunications and Internet 
infrastructure context. 

At the NSTAC XXV Meeting, participants also 
expressed concern over the ability to defend the 
Internet by protecting the edges of fhe Infernet 
against attack or exploitation. In response to these 
concerns, the lES tasked the ISATF to provide 
guidance on how to define the edge of the Internet. 

Through detailed analysis, the ISATF determined 
that because the Internet is not a single network 
but a network of Inferconnecfed nefworks, there 
is no single definition of the edge, as the definition 
depends on perspective. The ISATF also noted that 
there are many different ways to define fhe edge 
that include, but are not limited to the following: all 
sysfems that contain Internet Protocol (IP) addresses 
that do not route IP packets; the composition of 
information systems; and zones of responsibility for 
network operators versus end-users. In addition, 
the group noted that emphasis should focus not on 
defining fhe edge of the Internet but on defending 
the Internet as the adoption of a single definifion of 
the edge could prevent critical security precautions 
from being addressed in other areas. 

Based on the ISATF’s analysis, the NSTAC 
recommended to the President that: 

► The Government should continue its work 
to identify the critical national security and 
emergency preparedness missions and functions 
supporting those missions that rely on the Internet 
and encourage the parties responsible for those 
missions to ensure that they are adequately 
protected through redundancy and alternative 
capabilities; 

► Industry, standards bodies, software vendors, 
equipment vendors, network operators, and 
end-users of all producfs and services fhat make 
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up the Internet should ensure that these products 
have built-in baseline security features and that 
these capabilities are appropriately configured 
and kept current; and 

► The Government should work with Internet 
security experts and standards bodies to develop 
a standard set of key warnings and indicators 
that all service providers can use as a baseline to 
measure security threats. 

The NSTAC’s OAM&P Working Group recognized 
that Executive Orders, Presidential directives, 
and Presidential commissions have specified 
infrasfructures as nafional assefs that are critical 
to the defense and economic security of fhe 
United States. Telecommunications is one of these 
critical infrastructures. Security for the network 
management functions controlling this infrastructure 
is essential. Many standards for network 
management security exist; however, compliance 
is low and implementation is inconsistent across 
the various telecommunications equipment and 
software providers. In addition, service providers are 
specifying confradicting requiremenfs for products, 
which results In Inconsistent vendor feature sets 
and potentially higher costs for vendors. Finally, 
as the telecommunications industry transitions to 
a converged network environment, new security 
challenges emerge; and threats In the public network 
become threats in the management and control 
planes. 

Previous NSIE security assessments of the public 
network have also documented the management 
plane's vulnerabilities and susceptibility to intruder 
attacks. Because an increasing number of networks 
are closely tied to intranets, these networks are 
susceptible to hacker threats. Furthermore, the lack 
of sfandards fo address this issue enables intruders 
to penetrate vulnerabilities and further deteriorate 
the telecommunications networks. Therefore, 
an urgenf need exisfs for this baseline standard 
to provide much-needed security mechanisms 
for telecommunications carriers and vendors to 
implement. 
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The OAM&P Standard Working Group reviewed 
Tl.276-2003 and concluded that the current 
standard addresses only one aspect (such as, 
the management plane) of an overall end-to-end 
security solution. Tl.276-2003 addresses security for 
network element, management system, and element 
management system equipment only; it does not 
specifically address security for other equipment, 
such as customer premises equipment. Apart from 
the Tl.276-2003 requirements, the current standard 
assumes that effective hardware and software 
controls provided by the operating system protect the 
data and resources being managed. 

In addition, the OAM&P Standard Working Group 
developed recommended to the President that: 

► The National Institute of Standards and 
Technology (NIST) review the Tl.276-2003 
standard. If a review finds a conflict between 
the Tl.276-2003 standard and existing Federal 
Information Processing Standards and NIST 
publications, NIST should make these conflicts 
known to the appropriate standards bodies; 

► Federal departments and agencies be 
encouraged to use the Tl.276-2003 standard in 
requests for proposals, as appropriate; and 

► Through the DHS, encourage officials responsible 
for other infrastructures to consider the elements 
of the Tl.276-2003 standard as a baseline for 
security requirements and adapt appropriate 
requirements for their respective infrastructure. 

Actions Resulting from NSTAC Recommendations 

In response to an NSTAC XIV charge to continue 
network security activities, the IBS established the 
NSSC and the NSSOG. The IBS charged the NSSC 
to: 

► Oversee the NSIB and recommend NSIB follow-on 
activities; 

► Bstablish and oversee the NSTAC NSSOG; 
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► Continue involvement in R&D information 
exchange; 

► Represent the NSTAC on NSIB matters to the 
FCC Network Reliability Council (subsequently 
renamed the Network Reliability and 
Interoperability Council) and the Manager, NCS; 
and 

► Support other network security issues as required. 

The IBS charged the NSSOG to establish and 
prioritize industry objectives for network security 
standards to support NS/BP capabilities, and to work 
with the standards community to provide guidance 
and motivation to develop and accept industry-wide 
standards. 

In response to recommendations at NSTAC 
XV, Congress included provisions in the Violent 
Crime Control and Law Bnforcement Act of 
1994 that expanded the law's applicability to 
telecommunications operations, administration, 
maintenance, and provisioning systems. Flowever, 
the Act did not fully address the concerns that 
prompted NSTAC’s recommendations. Congress 
subsequently passed the National Information 
Infrastructure (Nil) Protection Act of 1996, which 
provides measures to strengthen Bederal laws 
against computer crime. 

As the IDSG focused primarily on R&D Issues related 
to Intrusion detection technology, the Government 
was exploring broader R&D issues. In particular, the 
President’s Commission on Critical Infrastructure 
Protection (PCCIP) examined R&D issues affecting 
the security of all critical infrastructures. NSTAC’s 
findings and recommendations are consistent with 
those resulting from the PCCIP’s work. Burther, 
Presidential Decision Directive (PDD) 63 assigned 
the Office of Science and Technology Policy (OSTP) 
responsibility for coordinating R&D agendas and 
programs for the Government through the National 
Science and Technology Council. 

Since NSTAC XX, three events occurred to address 
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the WOS's recommendations. First, the OMNCS 
began expanding the National Telecommunications 
Coordination Network (NTCN) to provide a 
mechanism to support intercarrier coordination in 
the event of a widespread outage. Second, the FCC 
designated a Defense Commissioner, and industry 
and Government developed procedural guidelines 
to help telecommunications carriers resolve Issues 
with the FCC. Third, Government began focusing 
more aftention on R&D and fhe need to advance the 
state-of-the-art equipment for software integrity and 
address the most significant vulnerabilities of new 
and evolving felecommunications technologies and 
services. 

Following NSTAC XXI, the Government took 
measures to make critical Government systems Y2K 
compliant and to develop contingency plans to deal 
with any potential system failures fhat might occur. 
NSTAC’s Year 2000 Problem Status Report, issued in 
September 1998, influenced the President’s Council 
on Year 2000 Conversion on the need to develop 
comprehensive contingency plans to mitigate any 
potential harmful effects on the Nation’s NS/EP 
posture. 

In response to the recommendation from fhe 
NSTAC’s June 1999 Network Group Internet Report: An 
Examination of the NS/EP Implications of Internet Technologies, 
the OMNCS established a permanent program 
to address NS/EP issues related to the Internet. 

The Priority Services and Internet Technology 
and Standards program actively promotes NS/EP 
requirements among pertinent standards bodies, 
including the Internet Engineering Task Force, the 
European Telecommunications Standards Institute, 
and the International Telecommunication Union. 

Following NSTAC XXII in June 1999, the NSTAC 
tasked the lES to develop recommendations for 
the President regarding how the Government can 
optimally focus Ifs efforts to enhance the security 
of the Nation’s NS/EP telecommunications and 
information technology systems. 

The lES subsequently formed the PSTF to address 
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this task. The PSTF’s objective was to examine 
current network security strategies to determine 
whether alternative strategies might more 
effectively diminish risk and, if appropriate, develop 
recommendations regarding those alternatives. The 
PSTF based the methodology for Its study, in part, on 
a model of network security developed by the IDSG 
in 1997. The IDSG identified four basic components 
of nefwork security: prevention, detection, response, 
and mitigation. Using this model, the PSTF sought 
to answer the question: Could the risk to network 
security be more effectively reduced by changing the 
relative focus of nefwork security efforts among these 
four components? 

While the PSTF initially expected to find an opfimal 
focus thaf mighf apply to all organizations, analysis 
of the data yielded a different answer, such as, 
security is not a “onesize-fits-all” proposition. While 
it is not feasible to specify an optimal focus among 
prevention, detection, response, and mitigation that 
will be suitable for all organizations, it is reasonable 
for each Individual organization to consider how it 
focuses its network security efforts among these four 
components and ensure that it employs a strategy 
that is optimal for its own needs. 

The PSTF subsequently identified a number of 
common themes among the organizations providing 
input to the study as well as some barriers that may 
impede the ability of an organization to implement 
an optimal focus among fhe four components. While 
the PSTF gathered a representative sample of data 
to reflect a broad range of industry perspectives, 
the PSTF determined that it did not have sufficient 
information to adequately reflect the Government’s 
perspective. Consequently, the PSTF decided to 
provide a status report to NSTAC XXIII in May 2000 
and recommended that the lES consider including in 
the NSTAC XXIV work plan the following fask: 

► Based on the preliminary analysis and general 
observations of the PSTF report, complete 
the analysis of the focus of network security 
efforts by seeking a broader range of inpuf from 
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Government and academia, as well as additional 
input from industry. 

At the NSTAC XXII meeting, the Honorable John 
Hamre, Deputy Secretary of Defense, discussed 
the need for open dialogue between industry/ 
Government in the current era of dynamic 
technological change. Dr. Hamre requested NSTAC’s 
assistance to “tackle the much deeper, more 
complicated problem, which is how do we embed 
security in depth in the infrastructure upon which 
we, the Government, depend and upon which 
you and your customers depend.” NSTAC’s lES 
subsequently began to scope this issue to determine 
how to respond to Dr. Hamre’s request. The lES 
tasked the EISISG to determine the depth and 
breadth of this request and provide the lES with a 
recommended action plan. 

The scoping concluded, through briefings and 
various interactions with industry and Government, 
that the NSTAC can help in two distinct ways: 

► Promote the Eederal Government's efforts to 
work with industry to accomplish their mission 
of incorporating electronic commerce into their 
operations; and 

► Individually support and participate in existing, 
successful industry and Government forums. 

Eollowingthe recommendation of the NSTAC based 
on the ISATE’s recommendation to establish a lead 
organization within the Department to coordinate 
with industry regarding threat warnings and 
notifications, DHS created the Information Analysis 
and Infrastructure Protection Directorate (which was 
reorganized in 2005 into other directorates within 
the Department) to identify and assess intelligence 
information concerning threats to the United States, 
issue warnings, and take preventative and protective 
action against those threats. Moreover, DHS 
consolidated the watch center capabilities of several 
Eederal Government agencies under its auspices. 


The U.S. Congress included a provision (section 
214) in the Homeland Security Act of 2002 
establishing the protection of voluntarily shared 
critical infrastructure information. 

The National Cyber Security Partnership (NCSP) 

Task Force 4, Working Group 5 designated a 
liaison to work with TlMl as they explore technical 
standards and Common Criteria. Tl.276-2003 will 
be one of the many standards that will be considered 
as the NCSP works to secure cyberspace. In 
addition, the International Telecommunication Union 
is developing an international standard based on the 
requirements outlined in Tl.276-2003. 

Finally, the General Services Administration required 
compliance by all Federal departments and agencies 
with the American National Standard T1.276- 
2003 on OAM&P security requirements for the 
management plane. 

Reports Issued 

Network Security Scoping Task Force Report: Report of the 
Network Security Task Force, October 1990. 

Network Security Task Force Finai Report, July 1992. 

NSTAC/NStE Report on Deficiencies in Federai Laws on Computer 
Cr/me, April/May 1993. 

Network Security Standards for the Pubiic Switched Network: 
issues and Recommendations, October 1994. 

An Assessment of the Risk to the Security of Pubiic Networks, 
Government and NSTAC NStEs, December 12,1995. 

Report of the Network Security Group Research and Deveiopment 
Exchange, September 18,1996. 

Network Security Group Eorward Looking Anatysis Panei 
Proceedings, November 19,1996. 

Locai Number Portabiiity and its tmpiications for the Pubiic 
Switched Network: An NStE White Paper, July 1997. 
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Software Integrity: An NSIE White Paper, July 1997. 

Report on the Likelihood of a Widespread Telecommunications 
Outage, December 1997. 

Report on the NS/EP Implications of Intrusion Detection 
Technology Research and Development, December 1997. 

The Insider Threat: Legal and Practical Human Resources 
Issues: An tISIE White Paper, April 1998. 

The Insider Threat to Information Systems: A Eramework for 
Understanding and Managing the Insider Threat in Today's 
Business Environment: An NSIE White Paper, June 1998. 

The President's NSTAC Research and Development Exchange 
Proceedings: Enhancing Network Security Technology R&D 
Collaboration, October 1998. 

An Assessment of the Risk to the Security of the Public Network, 
April 1999. 

Network Group Internet Report: An Examination of the NS/EP 
Implications of Internet Technologies, June 1999. 

Protecting Systems Task Eorce Report on Enhancing the Nation's 
Network Security Efforts, May 2000. 

Eirst Steps in Identifying and Remediating Vulnerabilities in 
Pervasive Software/Protocols, April 2003. 

Defining the Edge of the Internet, June 2003. 

Dperations, Administration, Maintenance, and 
Provisioning (CAM&P) Security Requirements for the 
Public Telecommunications Network: A Baseline of Security 
Requirements for the Management Plane, August 2003. 
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Obtaining Critical 
Telecommunications Facility 
Protection During a Civil 
Disturbance 

Investigation Group / Period of Activity 

NS/EP Panel 

September 1993 - April 1994 

Issue Background 

The April 1992 civil disturbance in Los Angeles 
identified the need for standardized guidelines in 
requesting the protection of critical telecommunications 
facilities. In response to the problems noted, the NS/EP 
Panel met with California Stafe, Federal Government, 
and telecommunications industry representatives in 
San Francisco. The meeting participants generally 
agreed that emergency response personnel were 
not sufficiently prepared to respond to the crisis that 
overwhelmed local law enforcement and fire 
protection services. 

Telecommunications industry representatives 
discussed their difficulties in obtaining protection for 
their facilities, while other participants acknowledged 
they had been confused abouf whom to contact 
and who had authority during the widespread civil 
unrest. Because the President declared the crisis 
to be a Federal emergency, points of contact and 
authorities changed, causing some confusion. 
Participants raised this issue at the meeting and 
questioned how to obtain critical telecommunications 
facility protection during a Federal emergency. DOJ 
and Department of Defense (DOD) represenfatives 
briefed the panel on the roles of the DOJ, the 
National Guard, and active duty military personnel 
during national emergencies. 

As a result of the meeting, the NCC, working 
closely with the NS/EP Panel, agreed to develop 
guidelines to assist emergency planners during their 
preparations for and response to civil disturbances. 
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The NS/EP Panel and the NCC developed the 
document in close coordination with the California 
Office of Emergency Services and the California 
Ufilities Emergency Association. 

In May 1994, the NCC and the NS/EP Panel 
issued Guidelines for Obtaining Protection of Critical 
Telecommunications Facilities During Civil Disturbances. The 
document serves as a guide for telecommunications 
industry emergency planners when discussing their 
facility protection needs with local. State, and 
Federal authorities. 

On October 4, 1995, the NS/EP Panel conducted an 
industry/Government Critical Telecommunications 
Facilities Protection exercise simultaneously at three 
separate locations using video teleconferencing 
linking sifes in Arlington, Virginia; Oakland, 

California; and Los Angeles, California. The exercise 
provided an opportunify for key emergency response 
planners af the local. State, and national levels 
to develop working relationships, gain a better 
understanding of the many planning factors required 
by each participant, and define the critical steps in 
the protection process. 

Participants noted this exercise helped clarify 
fhe lines of communicafion when requesting 
protection from fhe city to county to State to national 
levels and helped clarify fhe various roles and 
responsibilifies of the organizations involved. The 
activity also highlighted planning shortfalls that 
required correction to streamline the protection 
process. The NS/EP Panel identified two key issues 
for inclusion in the Guidelines for Obtaining Protection of 
Critical Telecommunications Facilities During Civil Disturbances 
document: (1) adding procedures for transitioning 
from Federal control back to State control and 
(2) discussing the legal aspects of federalized versus 
non-federalized troops. 

In an October 1996 conference call, parficipants 
of the industry/Government exercise discussed 
options for clarifying the federalization issues. The 
NS/EP Panel added new language to the document, 
indicating that both federalized and non-federalized 
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National Guard troops, each with different chains 
of command, may participate in restoring and 
maintaining law and order. In addition, the panel 
added a section authorizing the Secretary of Defense 
to determine when Federal military forces should 
withdraw from the disturbance area and when 
National Guard units would return to State control. 


Reports Issued 

Guidelines for Obtaining Protection of Critical Telecommunications 
Facilities During Civil Disturbances, May 1994. 

Protection of Critical Facilities Exercise, After-Action Report, 
December 1995. 
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Physical Security of the 
Telecommunications Network 

Investigation Group / Period of Activity 

Plans Working Group 

December 1990 - September 1991 

Vulnerabilities Task Force 

May 2002 - February 2003 

Trusted Access Task Force 

April 2003-April 2004 

Issue Background 

The United States Government recognizes the 
telecommunications sector as a critical component 
of national security and emergency preparedness 
(NS/EP) services and the potential for risk due 
to the growing reliance on the availability of 
telecommunications resources by the Government, 
other critical infrastructures, and the general public. 
Like all other critical Infrastructures In the United 
States, the communications infrastructure remains 
vulnerable to physical attacks that could significantly 
damage a facility or free standing component of the 
network severely enough to interrupt service. 

History of NSTAC Actions and Recommendations 

On December 13, 1990, at NSTAC XII, an NSTAC 
Principal questioned the physical security of the 
public switched network, due to issues surfaced by 
a National Research Council report on the growing 
vulnerability of the Nation’s communications network. 
As a result, the NSTAC established and tasked the 
Plans Working Group (PWG) with investigating the 
Committee's growing concerns related to physical 
security of the telecommunications infrastructure. 

In response, the PWG, in conjunction with the 
National Communications System (NCS) Cffice of 
the Joint Secretariat, prepared a physical security 
study that examined current industry/Government 
activities, including results from a questionnaire 
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given to the National Coordinating Center’s 
industry representatives on physical security 
policy, operational procedures, and methods. The 
study also documented past NCS efforts regarding 
physical security of NS/EP telecommunications 
facilities, sites, and assets and relevant conclusions 
and recommendations of those past efforts. The 
study concluded that current Industry/Government 
activity and past NCS documents demonstrated 
Industry and Government had made substantial 
progress In addressing the physical security of 
telecommunications facilities, sites, and assets. 
According to the study, physical security was well 
planned and managed In general. 

After reviewing the Information in this study, the 
NSTAC concluded that the document required no 
further NSTAC action at that time. 

The NSTAC again addressed physical security 
concerns during the business and executive 
sessions of the NSTAC XXV Meeting, at which time 
the Principals again raised concerns related to 
the physical security of the telecommunications 
infrastructure in the wake of the attacks against the 
United States on September 11, 2001. As a result, 
the NSTAC chartered the Vulnerabilities Task Force 
(VTF) to examine possible risks associated with 
the concentration of critical telecommunications 
assets in telecom hotels and Internet peering 
points, as well as vulnerabilities involving equipment 
chain of control and trusted access procedures to 
telecommunications facilities. The VTF concluded 
that, while the telecommunications infrastructure is 
inherently vulnerable to physical attack, the existence 
of multiple Interconnection facilities, such as telecom 
hotels, has helped to disperse telecommunications 
assets over numerous locations, thereby reducing 
service impacts caused by the loss of any one facility. 
The task force acknowledged that the physical 
destruction of individual critical telecommunications 
facilities could disrupt service at the local level and 
restrict access to the infrastructure. Therefore, site 
by site mission critical risk analyses are the only way 
for organizations to identify possible vulnerabilities 
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that could affect critical functions supporting 
those missions. 

The VTF also addressed the Government's concern 
that the telecommunications Infrastructure may 
be especially vulnerable because trusted physical 
access is granted to individuals requiring entrance 
to sites where critical telecommunications assets 
are concentrated. During its deliberations, the 
task force stressed how the nationwide web of 
telecommunicafions assets has become far foo 
extensive to ensure full access control to prevent 
tampering. While owners can secure critical sites 
and equipment to the extent possible with electronic 
locks, padlocks, fences, alarms, securify cameras, 
and fhe like, access control remains an Important 
issue because the loss of or damage fo a sife housing 
numerous crifical telecommunicafions assefs could 
have local or “lasf mile” impacfs and adversely 
affecf NS/EP services. Primary factors influencing 
the efficacy of access confrol procedures include 
individuals with malicious intent, the omnipresent 
insider threat, the lack of a standard personal 
identification and background check capabilities, 
and a lack of universally applied access control 
procedures and best practices. 

Furthermore, the VTF addressed chain of control 
issues regarding the security of producfs and 
services delivered to critical locations. The task 
force concluded thaf, alfhough securify will remain 
a priorify, no policy acfions are deemed necessary 
af this time. Flowever, if nefworks become relianf on 
commodity equipment, this could become an issue 
for consideration. 

In response to the analysis conducted by the 
VTF, and to mitigate any risks associated with 
concentration of assets, such as telecom hotels, 
the NSTAC presented four consecufive reports to 
the President titled Chain of Control, Telecom Hotels, 

Trusted Access, and Internet Peering Security w'dU specific 
recommendafions on measures to be undertaken to 
secure the telecommunications industry. 


In direct response to the work delineated in the 
Trusted Access Report, the NSTAC established the 
Trusted Access Task Force (TATF) and charged it 
to examine how industry and the Government can 
work together to address concerns associated with 
implementing a national security background check 
program for access fo key facilifies. 

In response fo fhe NSTAC’s earlier findings in fhis 
area, fhe TATF furfher examined fhe concerns fhaf 
fhe telecommunicafions infrasfructure may be 
vulnerable because trusted physical access is granted 
to individuals who require entrance to sites where 
telecommunications assets are concentrated without 
ensuring that the individual does not pose a threat to 
the facility or infrastructure. The task force proposed 
fhat a nafional standard for personnel screenings 
using Federal databases, such as the program used 
by the Department of Flomeland Securify’s (DFIS) 
Transportation Security Administration (TSA), may 
be beneficial for industry in mitigating threats to the 
telecommunications infrastructure. 

The TATF also examined the need for a standard. 
Industry-wide, certificate-based picture identification 
(ID) card. The group noted that the creation of 
such a card would furfher solidify fhe security of the 
Nation’s telecommunications infrastructure, and 
also assist In the Identification of fhose employees 
who have passed the national screening. In an 
emergency or crisis the credential will also expedite 
recovery efforts by helping to easily identify 
personnel who are needed af fhe sife. 

During the May 2004 NSTAC XXVII Meeting, the 
Assistant Secretary for Infrasfrucfure Protection, DFIS, 
emphasized the importance of fhe group’s work and 
commented on fhe need for short-term initiatives that 
could be undertaken to increase security at numerous 
upcoming National Special Security Events (NSSE), 
and could also be used as the basis for long-term 
perimeter access guidelines. As a result, the TATF, 
with the assistance of the NCC’s Information Sharing 
and Analysis Center (ISAC) member companies, 
proposed the establishment of a pilof program to 
pre-screen, against Federal terrorist lists/Government 


128 



The President’s National Security Telecommunications Advisory Committee 


databases, a small group of industry employees who 
may need access to physical sites or critical Information 
concerning NSSEs and associated critical facilities. The 
TATF deemed the United States Secret Service (USSS) 
the most appropriate resource for conducting industry 
screenings on the specified personnel due to their 
role in planning NSSEs. The pilot screening program 
produced a list of key lessons learned, as well as 
several human resources concerns from industry. 

Based on the TATE’s analysis the NSTAC 
recommended that the President direct the 
appropriate departments and agencies to: 

► Coordinate with industry to: 

• Implement and support a standardized 
screening process for industry to voluntarily 
conduct screenings on persons who 

have regular and continued unescorted 
access to critical telecommunications 
facilities {e.g., switching facilities), including 
telecommunications employees and vendors, 
suppliers, and contractor staff, including: 

- Modeling such a program after the current 
TSA program by including different relative 
background investigation levels for various 
facilities and personnel types; 

- Partnering with DEIS, through TSA, to upon 
request from industry, conduct screenings 
for industry personnel working at critical 
private telecommunications facilities; and 

- Working with NRIC to develop industry 
best practices defining specific criteria for 
determining which telecommunications 
employees should be subject to screenings. 

• Make available a standard “tamper-proof,” 
certificate-based picture identification 
technology to enable the positive identification 
of screened individuals at critical sites and to 
support both physical and logical access for 
such individuals to critical telecommunications 


NSTAC XXIX Issue Review ► PREVIOUSLY ADDRESSED ISSUES 


facilities and the networks and information 
concerning them by building on the ongoing 
work of the General Services Administration’s 
Federal Identity Credentialing Committee. 

• Build on the recommendations in the NCC 
ISAC report, Preparing for a National Special Security 
Event, to develop a national plan for controlling 
access at the perimeter of an NSSE or a 
disaster area. To facilitate the development 
of a national perimeter access plan to be 
incorporated in the National Response Plan, the 
Government should continue to support the 
screening program coordinated by the NCC 
ISAC with screenings facilitated by DHS and 
the USSS. 

► Partner with the ISACs across infrastructures to 
implement screening, credentialing, and access 
control policies mirroring those recommended 
for the telecommunications infrastructure for all 
critical infrastructures. 

Actions Related to NSTAC Recommendations 

In accordance with the NSTAC’s recommendations 
and the NCC’s Preparing for a National Special Security 
Event Report, the Government implemented a pilot 
program to coordinate industry access for fhe 
2005 Presidential Inauguration. In addition, in a 
related effort, the NCS developed in early 2006, 
in partnership with Federal, State, and local 
Government entities, as well as a private sector 
company, an access standard operating procedure 
(SOP) to ensure that private critical infrastructure 
responders have priority access to disaster areas. 

The access SOP has been adopted by the State of 
Georgia and is currently being used as an example 
for other States. 
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Reports Issued 

lES Plans Working Group, A Review of Physical Security, 
September 1991. 

Vulnerabilities Task Force Report: Chain of Control, March 2003. 

Vulnerabilities Task Force Report: Telecom Hotels, March 2003. 

Vulnerabilities Task Force Report: Trusted Access, March 2003. 

Vulnerabilities Task Force Report: Internet Peering Security, 

April 2003. 

Trusted Access Task Force Report: Screening, Credentialing, and 
Perimeter Access Controls Report, January 2005. 
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Response to September 11,2001, 
Terrorist Attacks 

Investigation Group / Period of Activity 

September 11 “Lessons Learned” Ad Hoc Group 

October 15,2001 - Decembers, 2001 

Issue Background 

The terrorist attacks of September 11, 2001, 
required industry and Government to marshal 
resources at the national. State, and local levels to 
support response and recovery efforts. A critical part 
of those efforts was the restoration of emergency 
telecommunications services and the provisioning of 
communications to emergency response personnel. 
The National Communications System and the NCC, 
in partnership with NSTAC companies, played a 
major role in ensuring a quick response and recovery 
of telecommunications capabilities in the wake of the 
September 11th attacks. Subsequently, in response 
to a request from the Special Advisor to the President 
for Cyberspace Security, the NSTAC formed the 
September 11th “Lessons Learned” Ad Hoc Group to 
provide an industry perspective on lessons learned in 
responding to the September 11th tragic events. The 
NSTAC Chair discussed the ad hoc group’s analysis 
in its December 12, 2001, letter to the President. 

History of NSTAC Actions and Recommendations 

After identifying nearly 40 policy and operational 
lessons learned from the September 11, 2001, 
response, the ad hoc group narrowed its focus to 
the following issues: access procedures to disaster 
sites, communications procedures, and industry 
representation within the NCC. 

The major issue dealt with procedures for access to 
disaster sites affected by the attacks. Specifically, 
inconsistent access control procedures for moving 
telecommunications equipment and personnel into 
and out of the World Trade Center disaster area 
created confusion and presented obstacles for the 
telecommunications companies engaged in the 
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restoration of the infrastructure. Procedures were 
revised each time a new authority took responsibility 
for managing access to the disaster area. Depending 
on the phase of the response, local responders. 

State authorities, or Federal personnel were in 
control. The invocation of both crisis management, 
i.e. law enforcement officials treated the disaster 
area as on ongoing crime scene, and consequence 
management measures served to complicate the 
access control issue even further. 

Based on the ad hoc group’s analysis, the NSTAC 
recommended that the President direct the 
appropriate departments and agencies to lead a 
national effort to examine remedies to perimeter 
access control issues. The NSTAC determined 
that these remedies should consider overlapping 
jurisdictions and result in consistent processes 
and procedures for incorporation into the Federal 
Response Plan and State and local emergency 
response plans. The objective was to ensure that 
any future national response efforts to unanticipated 
attacks would be fully planned and coordinated and 
consistently carried out without delay. 

Additionally, the ad hoc group addressed 
communications procedures during emergencies. 
The events of September 11, 2001, demonstrated 
the need for standard procedures to improve 
communications among decision makers, 
operational personnel, and other stakeholders during 
emergencies. Such procedures would have to take 
into account the severity of the emergency, the 
classification of the communications, the location 
of the communicators, and the telecommunications 
capabilities available, among other factors. The 
ad hoc group found that the requisite operational 
procedures were already developed and in place at 
the NCC, including procedures related to the NCC’s 
Telecom-ISAC function. The NSTAC had consistently 
identified ISACs as the appropriate focal points 
for coordinating communications among industry 
players and between industry and Government in 
the new threat environment. Consequently, the ad 
hoc group concluded that the telecommunications 
industry should work through NCC representatives 
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to address communications requirements during Report Issued 

emergencies. 

NSTAC Letter to the President, December 17, 2001. 

The ad hoc group also analyzed NCC industry 
representation. The group acknowledged that the 
NCC must maintain proper industry representation 
to meet operational challenges In the evolving threat 
and technology environments. In the aftermath of the 
September 11, 2001, attacks, the NS/EP community 
reaffirmed the critical role wireless communications 
plays in response to national emergencies. Similarly, 

Internet services were deemed to be increasingly 
important in disaster response and central to 
the mission-critical operations of business and 
Governmenf agencies. Accordingly, the ad hoc group 
examined the mix of industry representation in the 
NCC and found fhat NCC members represented 

(1) the majority of the wireless carrier market share; 

(2) more than half of the Internet backbone provider 
market; and (3) a minority of the Internet access 
provider market. The ad hoc group concluded that 
augmenting Internet access provider membership in 
the NCC could help the NCC better address potential 
network security Issues. Such Issues included the 
threat of distributed denial of service attacks and 
software viruses launched by end users i//a dial-up 
connecflons to the network. 

As part of Ifs lessons learned analysis, the ad hoc 
group reviewed previous NSTAC recommendations, 
recognizing that the NSTAC’s cumulative work could 
provide valuable Information related to ensuring 
reliable infrastructure services and securing the 
Nation’s critical facilities. The group also recognized 
that the sharing of such informafion had gained new 
importance with the national focus on homeland 
security. Previous NSTAC studies selected for review by 
the group were in the areas of cellular priority access, 
energy service priority, protection of crifical facilities, 
public network convergence and vulnerabilities, and 
national information sharing, analysis, and warning. 

The group concluded that such studies and associated 
recommendations could demonstrate best practices for 
use by other organizations concerned with the physical 
and cyber security of crifical infrastructures supporting 
multiple sectors. 
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Telecommunications Industry 
Mobilization 

Investigation Group / Period of Activity 

Telecommunications Industry Mobilization (TIM) Task Force 

June 7, 1985-June 8,1989 

Issue Background 

Recognizing the prominent role of the 
telecommunications industry in a national 
mobilization, the NSTAC formed the TIM Task Force 
and instructed it to develop an issue statement. 
Meanwhile, the OMNCS developed the NS/EP 
Telecommunications Plan of Action to implement relevant 
portions of E.O. 12472 and National Security 
Decision Directives 47 and 97. The plan, approved 
by the NCS Committee of Principals (COP) in 1985, 
included an action to provide Government leadership 
in telecommunications industry mobilization 
planning activities. 

In September 1985, the TIM Task Force identified the 
following mobilization subjects as needing further study: 

► Telecommunications service surge requirements; 

► Personnel issues; 

► Maintenance of stockpiles and Inventories; 

► Dependence on foreign sources; 

► Dependence on other infrastructure systems; 

► Industry and Government mobilization 
management structure; and 

► Jurisdictional issues. 

The TIM Task Force recommended a Industry 
and Government forum be established to assess 
the seven TIM subject areas. In December 1985, 
industry and Government concurred with the 
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formation of the Joint Industry/Government TIM 
Group, which began addressing TIM subjects on 
January 29, 1986. 

History of NSTAC Actions and Recommendations 

The NSTAC approved and forwarded to the 
President the Joint TIM Group’s reports. Personnel 
Issues and Dependence on Foreign Sources, on November 
6, 1987, and approved and forwarded to the 
President the reports. Government and Industry 
Mobilization Management Structure and Maintenance of 
Stockpiles and Inventories on September 22, 1988. 

On June 8, 1989, the NSTAC approved and 
forwarded to the President the Joint TIM Group’s 
final reports on Telecommunications Service Surge 
Requirements, Dependence on other Infrastructure Systems, 
and Jurisdictional Issues, a final report with overall 
recommendations on telecommunications industry 
mobilization. The NSTAC then disbanded the Joint 
TIM Group. 

Actions Resulting from NSTAC Recommendations 

The original Energy Task Eorce further defined the 
TIM recommendations on energy Issues, Including 
underground storage tank regulations. 

The National Security Council and the Executive Office 
of the President initiated a review of overall national 
security mobilization preparedness. The Eederal 
Emergency Management Agency implemented 
several TIM recommendations as part of the Graduated 
Mobilization Response Plan. The OMNCS Office of the 
Joint Secretariat developed a plan of action, involving 
all NCS member organizations, designed to track 
implementation of the TIM recommendations. The 
plan included identification of task responsibilities, 
a time-phased work plan, and a schedule of status 
reports. The Baseline Mobilization program involved 
assigning “lead” organizations to follow up and 
take actions necessary to Implement each TIM 
recommendation during a 3-year period, with 36 tasks 
distributed among the NCS member organizations. 

In September 1993, the OMNCS Office of the Joint 
Secretariat Issued Its Final Report on TIM Recommendations. 
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The report presented the actions taken by various 
NCS member agencies on 11 recommendations 
having a significant and immediate effect on 
NS/EP telecommunications. The remaining 25 
recommendations, while of considerable importance, 
were of somewhat lesser significance relative to their 
immediate Impact on NS/EP telecommunications. 

The telecommunications industry had substantially 
implemented those recommendations and the report 
addressed them. The OMNCS believed that the 
agencies assigned to implement the recommendations 
had responded favorably, and that the TIM program 
could be considered a success. The OMNCS also 
believed that further formal monitoring of the TIM 
program was not necessary. 


Reports Issued 

Volume I, TIM Issue Statement, September 5,1985. 

Volume II, Background and Supporting Material, September 5,1985. 

Personnel Issues, September 1987. 

Dependence on Foreign Sources, October 1987. 

Government and Industry Mobilization Management Structure, 
June 1988. 

Maintenance of Stockpiles and Inventories, June 1988. 
Telecommunications Service Surge Requirements, January 1989. 
Dependence on Other Infrastructure Systems, April 1989. 
Assessment of TIM Capabilities (V. I), April 1989. 

TIM Subject Reports {V. II), April 1989. 

Jurisdictional Issues, April 1989. 

Exercise Participation, April 1989. 

Final Report on TIM Recommendations, September 1993. 
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Telecommunications 
Service Priority 

Investigation Group / Period of Activity 

Telecommunications Service Priority (TSP) Task Force 

December 1984 - December 1990 


Issue Background 

In December 1984, the NSTAC identified TSP as an 
urgent issue because of fhe need for a system that 
authorized both priority provisioning and restoration 
of NS/EP services for Federal, State, and local 
governments and private users. The TSP System 
replaced the Restoration Priority (RP) System, which 
covered only the restoration of Federal Government, 
inter-city, and private lines. The NSTAC lES established 
the TSP Task Force on February 21, 1985, to advise 
and assist the OMNCS in developing the TSP System, 
specifically regarding provisioning, restoration, 
maintenance, legal, and regulatory issues. 

History of NSTAC Actions and Recommendations 

The task force worked closely with the OMNCS in 
the development of the TSP System and provided 
assistance with its implementation. Specifically, 
the task force had a significant advisory role in 
creating the Petition for Rulemaking and Proposed Federal 
Communications Commission (FCC) Rules for the TSP 
System. The task force also assisted the TSP 
Program Office in establishing the initial TSP System 
Oversight Committee charter. The NCS Council of 
Representatives (COR) TSP Subcommittee and the 
TSP Task Force drafted and approved the charter 
in February 1990, and the DOD and the General 
Services Administration (GSA) approved the charter 
in November 1990. Subsequently, adoption of an 
amendment occurred in April 1991. 

The task force had a role in both the creation of 
the TSP Oversight Committee and the selection of 
Oversight Committee members. During the week 
of September 28 through October 3, 1987, the 
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TSP Task Force and NCS COR met and discussed 
the operational framework for the TSP System, 
including the establishment of the TSP Oversight 
Committee. On March 29, 1990, the TSP Task Force 
recommended that the Manager, NCS, appoint 
the following initial members to the TSP Oversight 
Committee: AT&T, Contel, McCaw Cellular, MCI, 
Bellcore, Sprint, GTE, State of California, State 
of South Carolina, Department of Transportation, 
Federal Emergency Management Agency, DOD, GSA, 
Department of Energy, Department of Commerce, 
National Telecommunications and Information 
Administration, and the FCC. The NSTAC approved 
the membership list and delegated future industry 
TSP Oversight Committee membership nominating 
authority to the lES. 

Additionally, the task force assisted in developing 
the documentation that made the TSP System 
operational. The task force helped create the TSP 
Service Vendor Handbook, which provides operational 
details of the TSP System that service vendors will 
use as guidance for implementation and operation 
of TSP. The task force developed the TSP Information 
Guide, a TSP primer for small telephone companies, 
published by the United States Telephone 
Association in December 1989. Furthermore, the 
task force had a significant advisory role in creating 
NCS issuances on TSP procedures. Specifically, the 
task force helped develop NCS Directive 3-1, which 
clarified the responsibilities of and procedures for 
all TSP System entities. The task force also assisted 
in the development of the TSP Service User Manual, 
which provided a set of guidelines for all users of 
the TSP System. 

The task force presented its final report at NSTAC XII in 
December 1990, including a recommendation to the 
President, which stated that the Federal Government 
should continue to support and administer the TSP 
System, as defined in NCS Directive 3-1. 
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Actions Resulting from NSTAC Recommendations 

TSP System implementation began on September 
10, 1990. The implementation plan included a 
2.5-year period for transition from the RP to the TSP 
System. The TSP System became fully operational on 
March 9, 1993. 

Today, the TSP Oversight Committee continues to meet 
on a biannual basis. Likewise, the OMNCS continues 
to provide the operational support for the TSP System. 


Reports Issued 

TSP Information Guide, December 1989 (published for the TSP 
Task Force by the U.S. Telephone Association, now the U.S. 
Telecom Association). 

TSP Service Vendor Handbook (NCSH 3-1-2), July 1990. 

Final Report of the TSP Task Force, September 1990. 
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Telecommunications Service 
Priority Carrier Liability 

Investigation Group / Period of Activity 

Industry Executive Subcommittee (lES) 

Funding and Regulatory Working Group (FRWG) 

November 16,1990-January 31,1991 


Issue Background 

The Federal Communications Commission 
Telecommunications Service Priority (TSP) Report and 
Order authorizes telecommunications carriers to 
install or restore NS/EP telecommunications on a 
priority basis over services that do not serve NS/EP 
requirements. The FRWG reviewed this issue to 
further define the protection against liability offered 
by the TSP Report and Order. One area of concern 
identified by the working group was 911 service. 

The working group concurred that the TSP Report and 
Order ottered adequate protection to carriers. The 
FRWG also observed that services provided under 
contract rather than through tariffs may not be 
protected by the TSP Report and Order \ar\guage. The 
FRWG reached the following conclusions: 

► The TSP Report and Order ottered sufficient protection 
against liability charges arising from the disruption 
of non-NS/EP user tariffed services; 

► The TSP Report and Order had not fully defined the 
legal ramifications of preempting a contracted 
versus a tariffed service; and 

► Carriers should develop internal policies for 
preempting non-NS/EP users. 

On March 15, 1991, the FRWG reported its 
findings to the lES. The lES concurred with the 
FRWG’s findings. 
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Telecommunications Systems 
Survivability 

Investigation Group / Period of Activity 

Telecommunications Systems Survivability (TSS) Task Force 

March 6,1986-June 8,1989 

Issue Background 

The NSTAC developed the TSS issue in 
December 1982 to address all aspects of the 
telecommunications survivability question. The 
Commercial Satellite Survivability (CSS) and 
Commercial Network Survivability (CNS) issues 
evolved from the NSTAC’s initial focus on TSS. On 
March 6, 1986, the NSTAC lES established the TSS 
Task Force and directed it to determine whether 
NSTAC recommendations had inconsistencies, 
whether the recommendations met the Government's 
NS/EP telecommunications policy requirements, 
and whether the Government effectively responded 
to the recommendations. In early 1987, the NSTAC 
charged the TSS Task Force to assess the impact 
of new technologies on telecommunications 
survivability. 

The TSS Task Force concluded that no serious 
inconsistencies or gaps existed among NSTAC 
recommendations and the recommendations 
sufficiently met the Government’s NS/EP 
telecommunications policy objectives. The NSTAC 
forwarded to the President the TSS Task Force 
recommendation to initiate a study to identity options 
for ensuring survivable electric power. The TSS Task 
Force completed reports on Government actions taken 
in response to NSTAC recommendations from the CNS, 
CSS, and Electromagnetic Pulse Task Forces, and 
submitted them to the NSTAC on November 6, 1987. 
The task force submitted similar reports on automated 
information processing and the National Coordinating 
Mechanism to NSTAC IX on September 22, 1988. The 
NSTAC approved these reports and forwarded them to 
the President on the respective dates. The TSS Task 
Force also completed an assessment of the applicability 
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of network management technology to NS/EP 
telecommunications survivability, which the NSTAC 
forwarded to the President on September 22, 1988. 

The TSS Task Force assisted the OMNCS in developing 
the Federal Government’s policy on essential line 
service (ELS). 

On June 8, 1989, the NSTAC approved the TSS Task 
Force’s final report and disbanded the task force. 

The NSTAC also directed the lES to proceed with 
the study of intelligent networks and virtual networks 
usefulness for enhancing network survivability, which 
the TSS Task Force initiated, pending review of the 
issue by the lES Plans Working Group (PWG). 

History of NSTAC Actions and Recommendations 

The NSTAC approved the TSS Task Force’s final report 
and disbanded the task force on June 8, 1989. 

Actions Resulting from NSTAC Recommendations 

The TSS Task Force’s electric power recommendations 
led to the establishment of the original Energy Task 
Force, and the intelligent networks study led to the 
establishment of the Intelligent Networks Task Force. 
The lES, through the OWG NS/EP Panel, provides 
a continuing evaluation of the overall progress and 
direction of TSS. The NS/EP Panel identifies any new 
concerns relating to TSS, advises the OWG of areas 
requiring NSTAC or NCS actions or study, monitors the 
status of general survivability of telecommunications 
systems, and reports periodically on the status of TSS 
to the OWG. 

As part of the CNS program, the OMNCS Office 
of Plans and Programs monitored network 
management developments, including local 
exchange carrier network management capabilities. 

In addition, members assigned to the OMNCS Office 
of Technology and Standards Network Management 
and Technology Planning task assessed the effects 
of congestion on NS/EP telecommunications 
and how expert systems could improve network 
management for NS/EP telecommunications. The 
NCS continued to encourage compliance with NCS 
Notice 3-0-1, NS/EP ELS, which recommended that 
Federal departments and agencies having NS/EP 
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telecommunications missions consider obtaining 
ELS to increase their probability of obtaining a 
timely dial tone. The Department of Energy was 
direcfed to implement several Energy Task Eorce 
recommendations. 


Reports Issued 

TSS: Industry Responses to May 13,1983 Questionnaire, 
September 1983. 

TSS Task Force-Subgroup 1 Review, September 1986. 

TSS Task Force-Review of Power, September 1986. 

TSS Task Force-Review of Security, September 1986. 

TSS Network Management Report, June 21,1988. 

TSS Review of Government Actions in Response to 
NSTAC-Recommended Initiatives, June 21,1988. 

TSS Electric Power Survivability Status Report, August 9,1988. 

TSS Task Force Final Report: Telecommunications System 
Survivability-Assessment and Future Directions, May 2,1989. 
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Underground Storage Tanks 

Investigation Group / Period of Activity 

Industry Executive Subcommittee Funding and Regulatory 
Working Group (FRWG) 

April 12,1990-March 1,1991 

Issue Background 

In 1988, the Energy Task Force voiced concerns 
that the Environmental Protection Agency (EPA) 
regulations on underground fuel storage tanks would 
encourage telecommunications carriers to reduce the 
amount of fuel available for their backup generators. 
The EPA regulations (40 Code of Federal Regulations Part 
280), originally proposed in April 1987, included 
standards for maintaining the integrity of the tank, 
protecting against spill and overfill, and detecting 
leaks. The telecommunications industry modified 
or replaced several fhousand underground storage 
tanks (LIST) pursuant to these regulations and added 
detection monitoring systems. 

The Energy Task Force considered the implications 
of the regulations and concluded that if fhe 
telecommunicafions industry complied with the new 
EPA regulations, the public switched network might 
not have enough backup fuel storage capacity in all 
locations to operate through normal power outages. 
The Energy Task Force recommended that the 
Government grant a national security waiver from 
those parts of the regulations that affected NS/EP 
telecommunications providers. 

The FRWG received briefings from the EPA and 
support staff on EPA LIST regulations. The FRWG 
also investigated LIST regulations at the Federal, 
State, and local levels. The group also surveyed 
several local exchange carriers and interexchange 
carriers to determine LIST policies and procedures. 
The survey revealed that industry was reviewing the 
LIST requirements as a result of fhe EPA regulafions, 
and fhat companies used several criteria when 
developing LIST requirements. The FRWG developed 
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a paper outlining the LIST issue and recommended 
the following: 

► A waiver of EPA LIST regulations should not be 
pursued. The waiver would not make a significant 
contribution to meeting Government backup 
power needs because companies were already 
pursuing their own LIST programs. State and 
local regulations would be addressed regardless 
of any Federal waiver, and telecommunications 
companies would probably not use Federal 
waivers unless mandated by the Government. 

The FRWG supported the implementation of an 
Energy Task Force recommendation: 

► Government should specify an NS/EP backup fuel 
requirement in cooperation with industry. 

Actions Resulting from NSTAC Recommendations 

At the December 12, 1990, NSTAC XII Meeting, 
members agreed with the recommendation not to 
pursue a waiver of EPA LIST regulafions. 

Report Issued 

Energy Task Force Final Report, February 1990. 
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Wireless Security 

Investigation Group / Period of Activity 

Wireless Task Force (WTF) 

April 2002 - January 2003 

Issue Background 

Numerous wireless technologies are being used with 
greater regularity to transmit voice, data, and video 
in support of NS/EP operations. However, there are 
increasing concerns that wireless communications 
could expose NS/EP users to new security threats 
and vulnerabilities. As such, the NS/EP community 
needs to understand its security requirements and 
identify potenfial wireless vulnerabilities. 

Challenges exist at many levels, including product 
design, wireless standards, and wireless/Internet 
convergence. First, the wide use of commercial 
off-fhe-shelf products and legacy equipment by the 
NS/EP community is an important consideration 
because these devices and equipment were not 
designed with NS/EP security requirements in 
mind and sometimes without security features 
at all. Second, interoperability issues arise from 
the implementation of differenf security models 
and standards—for instance, there are several 
conflicting policies either established or in 
development, designed to inhibit or prohibit the use 
of particular wireless capabilities and connectivity 
to classified networks and computers. Third, the 
extension of fhe Internet into the wireless domain 
adds new security challenges. 

At the NSTAC XXV Meeting held on March 13, 

2002, participants discussed the topic of security 
vulnerabilities in wireless communications devices 
and networks. Since subscribers use wireless 
technologies to transmit voice, data, and video in 
support of NS/EP operations, meeting participants 
agreed that the NS/EP community needed to identify 
its security requirements and understand potential 
wireless vulnerabilities. After an initial scoping of 
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wireless security and other related wireless issues, 
the NSTAC lES formed fhe WTF at its April 18, 2002, 
meeting. The lES tasked the WTF to determine how 
the NS/EP user can operate in a secure environment 
and to provide conclusions and recommendations to 
the President regarding wireless security. 

History of NSTAC Actions and Recommendations 

To adequately discuss these subjects and 
formulate actionable recommendations designed 
to help offset wireless threats and vulnerabilities, 
the WTF agreed to: (1) define the terms “wireless” 
and “wireless security;” (2) identify NS/EP wireless 
users’ unique requirements; (3) compile a list of 
wireless vulnerabilities and threats; and (4) where 
known, identify mitigation approaches to address 
wireless vulnerabilities and threats. The task 
force used the expertise of subject matter experts 
from NSTAC member companies, as well as 
other information technology companies, industry 
associations, and Government participants, 
throughout its study of wireless security. 

After defining NS/EP user requirements, the task 
force identified advantages to using wireless systems 
for NS/EP communicafions, as well as vulnerabilities 
and threats that must be addressed before using 
wireless capabilifies for mission-critical NS/EP 
communications. The WTF’s findings concurred 
wifh ofher prevalent studies, which determined that 
any vulnerabilities that exist in conventional wired 
and computer communications and networks are 
applicable to wireless technologies. 

The WTF concluded that there is a range of wireless 
security, which varies from effecfive, pracfical 
security on the commercial wireless networks, to 
significantly less security on the public wireless 
networks. As such, an NS/EP agency must ensure 
that its NS/EP communications are secured 
appropriately for its mission. The WTF also agreed 
that the extent to which these vulnerabilities have 
been or can be addressed would be a function of 
fhe degree fo which organizafions with experience in 
security issues manage the network. 
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The WTF concluded its analysis of wireless security 
in January 2003 and presented its findings in its WTF 
Report on Wireless Security. The task force found 
that wireless security challenges exist at many levels, 
including product design, wireless standards, and 
wireless/Internet convergence. Based on its analysis of 
issues related to wireless security, the NSTAC offered 
the following recommendations to the President: 

► Direct Federal departments and agencies to 
construct mitigation and alleviation policies 
regarding wireless vulnerabilities and further 
consider the applicability of the recent wireless 
security policies of the NIST and the Department of 
Defense to all Federal departments and agencies; 

► Direct Government chief information officers to 
immediately emphasize enterprise management 
controls, with respect to wireless devices, to 
ensure that appropriate security controls are 
implemented, given that the banning of wireless 
devices is counterproductive and ignores the 
efficiency that such devices brings to users; 

► Direct Federal departments and agencies to 
work in concert with industry to develop security 
principles and to resolve security-related 
deficiencies in wireless devices when employed 
by NS/EP users; 

► Direct Federal departments and agencies 
using wireless communications to address 
wireless security threats and vulnerabilities, 
and to consider the end-to-end security of their 
respective communications and information 
system capabilities; 

► Direct Federal departments and agencies using 
wireless communications to purchase and 
implement fully tested and compliant secure 
wireless products and services; 

► Direct appropriate staff to advocate funding 
initiatives for replacing non-secure analog with 
secure digital NS/EP equipment and systems; 
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► Direct Federal departments and agencies using 
microwave communications facilities to address 
unprotected link security vulnerabilities. In 
addition, advise State and local Governments 
and other critical infrastructure providers of 
the vulnerability of unprotected microwave 
communications as part of the homeland 
security initiative; and 

► Establish policies regarding the public availability 
and dissemination of Federal critical infrastructure 
information (such as the policies on Internet 
availability of the FCC and the Federal Aviation 
Administration databases of tower locations). 

At a December 2, 2002, lES Meeting briefing, 
the Chair of the President's Critical Infrastructure 
Protection Board requested that the WTF consider 
examining the security of Internet-enabled wireless 
communications devices and the efficacy of installing 
anti-virus software for wireless telephones, since such 
devices are becoming increasingly more integrated 
with computing functions. In response to the 
Administration’s request, the WTF scoped the issue. 

The WTF reported a number of observations on the 
security of Internet-enabled wireless devices in its 
Wireless Task Force Findings: Security of Internet-Enabled 
Wireless Devices, January 2003. The task force agreed 
that it is a serious issue, which is not limited exclusively 
to “wireless” or “third generation” wireless devices, 
because any device connected to the Internet can 
be attacked. The WTF concluded that although the 
tasking referenced wireless specifically, the NSTAC 
has already studied the larger issue as it relates to 
the convergence of telecommunications networks 
and the Internet. The complete findings based on the 
task force’s initial scoping were forwarded to NSTAC 
stakeholders for review. 

The WTF concluded its activities upon NSTAC 
approval of its reports and finalization of its findings 
on the security of Internet-enabled wireless devices. 
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Actions Resulting from NSTAC Recommendations 

NSTAC wireless security recommendations were 
formed after considerable collaboration with 
experts from industry and the Government. The 
recommendations were provided to and well 
received by other technical and policy advisory 
groups. For example, the Network Reliability 
and Interoperability Council (NRIC) VI, which 
assures homeland security, optimal reliability, 
interoperability, and interconnectivity of, and 
accessibility to, the public telecommunications 
networks, maintained close coordination with 
NSTAC efforts and recommendations. NRIC’s best 
practices and recommendations complemented 
NSTAC findings regarding wireless security 
principles and the resolution of security-related 
deficiencies in wireless devices. 


Reports Issued 

Wireless Task Force Report: Wireless Security, January 2003. 

Wireless Task Force Findings: Security of Internet-Enabled 
Wireless Devices, January 2003. 
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Wireless Services 
(Including Priority Services) 

Investigation Group / Period of Activity 

Wireless/Low-Bit-Rate Digital Services Task Force (W/L6RDSTF) 

March 1991 - October 1991 

Wireless Services Task Force (WSTF) 

December 1991 - September 1995 

Legislative and Regulatory Task Force (LRTF) 

February 2001 - Present 

Wireless Task Force (WTF) 

April 2002 - January 2003 

Issue Background 

At its March 15, 1991, meeting, the President’s 
National Security Telecommunications Advisory 
Committee’s (NSTAC) Industry Executive Subcommittee 
(lES) established the Wireless/Low-Bit-Rate Digital 
Services Task Eorce (W/LBRDSTE) to address Office 
of the Manager, National Communications System 
(OMNCS) concerns about the possible adverse effects 
of developments In the rapidly evolving wireless 
telecommunications sector that would impact the 
public switched network’s ability to handle secure voice 
and data communications. The OMNCS recommended 
that the task force’s charge be to: (1) define the scope 
of the issues regarding wireless services, and (2) advise 
the Government on how to minimize any adverse 
effects of emerging digital mobile communications 
standards and technologies on mobile national security 
and emergency preparedness (NS/EP) users. 

On October 3, 1991, in its final NSTAC XIII 
report, the W/LBRDSTF concluded that no 
Government organization existed for defining NS/EP 
requirements for wireless digital communications. 

In addition, the task force determined that 
compatibility problems existed between certain 
existing and developing voice/data devices (for 
example, secure telephone unit [STU]-III analog) 
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and the emerging digital wireless network. Based on 
the task force’s report, the NSTAC recommended 
that the Government determine the appropriate 
organization to address and monitor wireless digital 
Interface issues. Accordingly, the Government 
tasked the OMNCS Wireless Services Program 
Office (WSPO) with the responsibility. 

In December 1991, following the establishment of 
the WSPO, the lES approved the establishment of 
a follow-on Wireless Services Task Force (WSTF). 

The lES tasked the WSTF to provide an industry 
perspective to the WSPO and to assist in developing 
a plan of action for addressing NS/EP wireless 
Issues. This included Identifying Government 
requirements and developing a white paper to 
support standards activities. The lES also instructed 
the task force to continue its investigation into 
wireless services supporting NS/EP. To that end, the 
task force surveyed the evolving wireless services 
environment and identified and assessed candidate 
solutions that would ensure Interoperability and 
connectivity among wireless services and between 
wireless and non-wireless systems. The WSTF, in 
conjunction with the OMNCS WSPO and the Federal 
Wireless Users Forum, addressed methods for 
incorporating priority access into wireless systems for 
NS/EP use. In addition, they determined the potential 
for emerging wireless technologies to complement 
existing communications support in the Federal 
Response Plan {FRP) Emergency Support Function 
(ESF) #2 (Communications). 

The WSTF established the Cellular Priority Access 
Services (CPAS) subgroup in July 1994 to investigate 
technical, administrative, and regulatory issues 
associated with the deployment of a nationwide 
priority access capability for NS/EP cellular users. 

On March 2, 1995, the lES instructed the WSTF 
to determine the NS/EP implications of, and scope 
the future task force involvement in, wireless 
technologies. These technologies include land 
mobile radio/speciallzed mobile radio, mobile satellite 
services, personal communications services, and 
mobile wireless access to data networks. 
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At its September 22, 1995, meeting, the lES placed 
the WSTF on standby status until needed by the 
Government. At that meeting, the lES also voted 
to place the CPAS subgroup under the direction 
of the NS/EP group. Since then, the subgroup has 
assisted in developing CPAS forms and a manual 
for the administration of CPAS. Additionally, 
the subgroup monitored the development and 
modifications of standards and regulatory issues 
relevant to CPAS, which is now referred to as 
Wireless Priority Service (WPS). 

The NSTAC revisited WPS issues during the NSTAC 
XXVI cycle (March 2002-April 2003). After scoping 
current wireless Issues related to NS/EP users, the 
lES formed the Wireless Task Force (WTF) to study 
issues relating to the ubiquitous rollout of WPS at its 
April 18, 2002, meeting. In addition to analyzing the 
impediments to the ubiquitous rollout of WPS, the 
lES detailed the task force to study how WPS can be 
promoted publicly and explore non-device specific 
and secure solutions for deploying WPS. 

History of NSTAC Actions and Recommendations 

At the October 3, 1991, NSTAC XIII Meeting, 
the NSTAC approved the following W/LBRDSTF 
recommendations to the President: 

► The Government should establish a focal point, 
supported by the National Security Agency 
(NSA) and the National Institute of Standards 
and Technology (NIST), to address and monitor 
wireless digital Interface Issues; and 

► The Government should formulate policies at a 
high level to ensure that all wireless digital service 
acquisition activities take NS/EP needs into 
account. 

The NSTAC reconvened the task force following the 
establishment of the WSPO. 

At the March 4, 1994, NSTAC XVI Meeting, the 
NSTAC approved the WSTF report and forwarded 
recommendations to the Government on pursuing 
implementation of a single, nationwide priority 


access capability for NS/EP users and expanding the 
FRP ESF#2 planning process to make more effective 
use of wireless technologies and services. 

At the NSTAC XVII Meeting, held on January 12, 1995, 
the task force reported on Its activities in the areas of 
wireless interoperability and cellular priority access. 

At the NSTAC XVIII Meeting, the WSTF presented 
Its task force report and recommendations on the 
NS/EP Implications of land mobile radio/specialized 
mobile radio, mobile satellite services, personal 
communications services, and wireless data to the 
President. The report had several recommendations 
related to the Government continuing to actively exploit 
emerging technologies in support of NS/EP activities by 
working at the international, Federal, State, and local 
levels In defining wireless requirements. 

Additionally, the subgroup submitted the Cellular 
Priority Access Services Subgroup Report, which 
recommended the Government continue to gain a 
consensus on CPAS regulatory, administrative, and 
technical issues to finalize a comprehensive CPAS 
implementation strategy. 

At the NSTAC XXV Executive Breakfast on 
March 13, 2002, Senator Robert Bennett (R-UT) 
requested that the NSTAC revisit the issue of WPS 
and further examine obstacles to the ubiquitous 
rollout of WPS. In response to this charge, the 
NSTAC tasked the WTF with assessing the issues 
related to the ubiquitous deployment of WPS. 

The WTF closely monitored the deployment of 
WPS, noting that the ubiquitous deployment of 
the program had not been achieved for a variety 
of operational, technical, funding, and regulatory 
reasons. WTF members agreed that the ubiquitous, 
nationwide deployment of WPS would be achieved 
through the inclusion of all wireless technologies 
In the solution set, satellite back-up capabilities, 
and the participation of large and small wireless 
carriers. Members also cited inadequate Government 
funding, lack of liability protection for carriers, and 
technological limitations as additional impediments 
to the ubiquitous rollout of WPS. Lastly, the WTF 
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determined the need for an effective WPS outreach 
campaign to State and local Governments, smaller 
wireless carriers, private sector critical Infrastructure 
protection providers, and the general public. 
Providing these entities with timely and accurate 
information would dispel misconceptions regarding 
the WPS program and facilitate the inclusion of WPS 
in various NS/EP homeland security, contingency, 
and disaster recovery plans. 

As a result of fhls analysis, fhe NSTAC offered the 
following recommendations to the President: 

► Encourage the development of WPS solutions for 
all wireless fechnologies {e.g., cellular/personal 
communications service, third generation 
networks, paging, and other wireless data 
services) to maximize WPS coverage, increase 
ubiquity, and give NS/EP users the flexibility to 
handle a variety of emergencies and disasfers; 

► Reaffirm thaf fhe Eederal Communications 
Commission’s (ECO Second Report and Order 
(R&O) on Priority Access Service (PAS) does 
extend liability protection to wireless priority solution 
providers equivalent to liability protection found in 
wireline priorify communications programs; 

► Encourage and support adequate funding for fhe 
development and deployment of a multl-fechnology 
and multi-carrier WPS program. Including a satellite 
backup capability to continue through WPS full 
operational capability and later generations and 
integration with the Government Emergency 
Telecommunications Service (GETS); 

► Direct the appropriate departments and agencies 
to conduct outreach and educational campaigns 
regarding WPS and its role In homeland security, 
specifically fargefing: 

• Sfate and local Governments—Emphasizing 
the role of WPS in homeland securify and the 
Importance of expedifing zoning and siting 
requests from wireless carriers, including the 
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use of Governmenf sites and buildings, to 
increase WPS coverage and ubiquity 

• Smaller carriers—Educating them on WPS and 
encouraging their involvement In the program 

• Private sector critical infrastructure 
providers—Facilitating greater awareness of 
the WPS program and enabling improved 
contingency and disaster recovery programs 

• The general public—Detailing the benefits WPS 
provides for public safety and homeland security 

► Direct the National Communications System (NCS), 
Government agencies and departments, and 
organizations with NS/EP missions to implement 
proactive policies regarding the implementation and 
use of the WPS program, including: 

• Stockpiling WPS-enabled phones for large-scale 
distribution to NS/EP users during emergencies 

• Monitoring WPS usage following distribution 
of WPS handsefs to protect against fraud 
and abuse 

• Developing a WPS directory assistance 
function, enabling NS/EP users to locate one 
another during emergencies 

► Direct the NCS and Government agencies and 
departments involved in WPS planning and 
program management to address the technical 
limitations of wireless and other network 
technologies that may have a negative impact 
on the assurance, reliability, and availability of 
an end-to-end WPS solution. These limitations 
include but are not limited to: 

• Insufficient commercial capacity available to 
support NS/EP users 

• Technical infeasibllity of offering wireless 
priority at the network egress within the initial 
operating capability time frame 
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• Processing limitations of Signaling System 7 
(SS7) during periods of congestion 

• Security vulnerabiiities resulting from the 
convergence of voice and data networks and 
the SS7 

• Challenges associated with the integration of 
GETS with WPS. 

In addition, the WTF worked jointiy with the 
Legisiative and Reguiatory Task Force (LRTF) to 
assess the iegal and reguiatory concerns with 
WPS during the NSTAC XXVI cycle. Specifically, 
they addressed whether the FCC should revise the 
Second R&O for PAS. The NSTAC reviewed the 
R&O and, on January 22, 2003, sent a letter to the 
President offering recommendations on PAS. In the 
letter, the NSTAC commended the FCC for adopting 
a Second R&O for PAS, which indicates that carriers 
providing PAS shall have liability immunity from 
Section 202 of the Communications Act; states 
that the FCC and the National Telecommunications 
and Information Administration (NTIA) should 
accelerate on-going efforts to improve interoperability 
between Federal, State, and local public safety 
communications agencies; and encourages the 
Administration to support full and adequate Federal 
funding for PAS. 

Actions Resulting from NSTAC Recommendations 

A Memorandum of Understanding established the 
WSPO as the Government focal point within the 
OMNCS Technology and Standards Division (now the 
OMNCS Technology and Programs Division), with 
full-time participation from NSA and NIST. 

On October 19, 1995, the OMNCS, through the 
WSPO, submitted a CPAS Petition for Rulemaking to 
the FCC to authorize the nationwide CPAS service. 
After two years of soliciting comments from industry 
on the CPAS Petition for Rulemaking, the FCC 
adopted the First R&O for PAS on August 6, 1998. 


The OMNCS worked on CPAS implementation 
through four parallel approaches: modifying cellular 
standards to incorporate CPAS, encouraging the FCC 
to issue CPAS rules, developing CPAS administrative 
processes, and stimulating competitive interests of 
service providers to implement the CPAS capability. 
On July 3, 2000, the FCC adopted the Second R&O 
for PAS, establishing the regulatory, administrative, 
and operational framework enabling commercial 
mobile radio service providers to offer WPS to NS/EP 
personnel. The R&O also provided WPS priority 
levels and qualifying criteria to be used as the basis 
for all WPS assignments. In their rulemaking, the 
FCC determined that: (1) WPS was in the public 
interest; (2) WPS offering should be voluntary; 

(3) carriers should have limited liability if uniform 
operating procedures were followed; and (4) the 
NCS is responsible for day-to-day administration of 
the program. 

After the terrorist attacks of September 11, 2001, 
the NS/EP community had a renewed interest in 
fully implementing WPS and White House personnel 
directed the NCS to establish an active program. 

A WPS-like solution was made available in Salt 
Lake City in time for the 2002 Olympic Winter 
Games and the NCS launched an immediate 
solution in May 2002 in the greater metropolitan 
areas of Washington, DC, and New York City. As a 
result of the NCS integration into the Department 
of Homeland Security (DHS), WPS is now offered 
through the DHS Information Analysis and 
Infrastructure Protection (lAlP) Directorate. WPS is 
offered in most major metropolitan markets on the 
Global System for Mobile Communications platform. 
The initial carrier for WPS is T-Mobile, which will 
reach full operating capability in 2004. In addition, 
the WPS program expanded to additional GSM 
carriers in 2004, including AT&T Wireless, Cingular, 
and Nextel. There are also plans to expand WPS 
to be offered on the Code Division Multiple Access 
platform in the future. 


150 


The President’s National Security Telecommunications Advisory Committee 


NSTAC XXIX Issue Review ► PREVIOUSLY ADDRESSED ISSUES 


Reports Issued 

Wireless/Low-Bit-Rate Digital Services Task Force Final Report: 
Towards National Security and Emergency Preparedness 
Wireless/Low-Bit-Rate Digital Services, September 1991. 

Wireless Services Task Force Report, January 1994. 

Emerging Wireless Services Report, September 1995. 

Cellular Priority Access Services Subgroup Report, 

September 1995. 

Wireless Task Force Report: Wireless Priority Service, 

August 2002. 
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Charter of the President’s National Security 
Telecommunications Advisory Committee 


I. Official Designation 

Under Executive Order 12382, dated September 
13, 1982, and Executive Order 13316, dated 
September 30, 2003, this Committee is officially 
designafed the President’s National Security 
Telecommunications Advisory Committee 
(“the Committee”). 

II. Membership and Organization 

A. Membership and organization will be in 
accordance with Executive Order 12382, dated 
September 13, 1982. 

B. There will be an Executive Secretary who will 
be the Manager, National Communications System, 
under section 10(e) of the Eederal Advisory 
Committee Act as amended (5 U.S.C. App. II). 

C. The Committee will provide such guidance 
and direction as is necessary and appropriate 
to ensure the effective functioning of any 
subcommittee so established. Except where a 
special rule applicable to such subcommittees 
appears in an amendment to this Charter, 

the provisions of fhis Charter shall apply 
(with necessary changes appropriate to 
subcommittees) to the subcommittees. 

D. The Chairman of the Federal Communications 
Commission will be Invited to participate in the 
activities of the Committee and its subcommittees. 
Agencies and officials of the Executive Branch may 
also be invited to participate. 

III. Objective, Scope of Activity, and Duties 

A. The Committee will function in accordance 
with Section 2 of Executive Crder 12382, dated 
September 13, 1982. The Committee will provide 


information and advice to the President on all 
telecommunications aspects affecting national 
security and emergency preparedness. Key 
policy statements include, but are not limited 
to, Executive Crder 12472, Assignment of 
National Security and Emergency Preparedness 
Telecommunications Functions and National 
Security Decision Directive Number 97 (NSDD-97), 
“National Security Telecommunications Policy.” 

B. The Committee’s officers will have the 
following responsibilities: 

1. The Chair will convene, preside at, and 
adjourn all meetings at his discretion, with the 
advance approval of the Executive Secretary. 
However, the Chair will also be obliged to 
adjourn any meeting the Executive Secretary 
advises him to adjourn when the Executive 
Secretary determines an adjournment to be in 
the public interest. 

2. The Vice Chair will act as Chair in the 
absence of the Chair. 

3. The Executive Secretary, who will be 
the Manager, National Communications 
System, will attend all meetings and will 
advise the Chair to adjourn, or will adjourn, 
any meeting when the Executive Secretary 
determines it is in the public interest. The 
Executive Secretary will invite agencies and 
officials from fhe Executive Branch to attend 
the meetings, as he deems appropriate. 

The Executive Secretary will prepare the 
minutes of each meeting, the accuracy of 
which the Chair will certify and fhat will 

at a minimum contain: a record of fhe 
membership presenf and fhe members of 
fhe public who participate in the meeting 
including the interests and affiliations they 
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represent; a description of matters and 
materials discussed and the conciusions, 
if any, reached; and the rationale for any 
recommendafions made by members of 
the Committee. The Executive Secretary will 
also maintain copies of all reporfs which the 
Committee receives, issues, or approves. 

C. The Committee may consult with interested 
parties, agencies, interagency committees, or 
groups of the United States Government and 
with private groups and individuals as the 
Committee decides is necessary or desirable. 

D. The NSTAC will address all matters pertaining 
to National Security/Emergency Preparedness 
(NS/EP) Communications (Cyber and 
Telecommunications). The NSTAC will coordinate 
NS/EP communications interdependency issues 
with the National Infrastructure Advisory Council. 

IV. Official to Whom the Committee Reports 

A. The Committee will report in writing to 
the President of the United States through the 
Secretary of Homeland Securify, in his capacity as 
Executive Agent for the National Communications 
System by Executive Order 13286, dated 
Eebruary 28, 2003. 

B. The Committee, and any subcommittees 
established by the Committee, will work with the 
Office of the Manager, National Communications 
System, and appropriate representatives from 
National Communications System member 
organizations. 

C. Any subcommittee established by the 
Committee will report to the Committee. 

V. Estimated Costs and Staff Support 

A. Members of the Committee will serve on it 
without any compensation for their work and in 
accordance with Section 3 of Executive Order 
12382, dated September 13, 1982. 
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B. The estimated annual cost of operating 
the Committee and its subcommittees is $2.6 
million, including travel expenses, per diem, 
contractor support, and staff support. 

C. The Department of Homeland Securify, in 
ifs capacity as Executive Agent for the National 
Communications System, will supply staff 
and supporf funcfions for fhe Committee. The 
esfimated annual personnel staffing of such 
functions is 7.5 staff years, excluding confracf 
support. 

VI. Meetings and Termination 

A. The Committee will meet approximately 
every 12 months in person and otherwise at the 
call of the Chair. Subcommittees will meet as 
necessary for fheir assigned responsibilifies. 

B. Under Execufive Order 13385, 
dafed Sepfember 29, 2005, effective 
September 30, 2005, the Committee will 
terminate on September 30, 2007, unless 
formally defermined fo be in the public interest 
to continue it for an additional period. A 
continuing need for fhe advice offered by this 
Committee is anticipated. 

VII. Filing Date 

December 14, 2005. 
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Bylaws of the President’s National Security 
Telecommunications Advisory Committee 


Adopted: 

July 20,1983 

Amended: 

June 8,1989 

Amended: 

January 12,1995 

Amended: 

April 18, 2000 

Amended: 

April 7,2003 


Article 1 

Organization and Operation 

Section 1 

The National Security and 


Telecommunications Advisory Committee (NSTAC) 
shall be organized and operate in accordance with 
the Federal Advisory Committee Act, as amended 
(5 U.S.C. App. 2), Executive Order 12382, 13 
September 1982, the Charter of the NSTAC, and 
these Bylaws. 

Section 2 The provisions of the Federal Advisory 
Committee Act, as amended (5 U.S.C. App. 2), 
Executive Order No. 12382, 13 September 1982, 
and the Charter of the NSTAC shall govern in the 
event of any conflict between the provisions thereof 
and these Bylaws. 

Section 3 The NSTAC shall be supported by 
an Industry Executive Subcommittee (lES). The 
lES is authorized to form subordinate Groups, titled 
Working Groups, Task Forces, or other appropriate 
title, necessary to carry out the direction provided by 
the NSTAC and to develop recommendations for the 
NSTAC in accord with the NSTAC Charter and the 
lES’s mission. The purpose of the lES is to advise the 
NSTAC on matters concerning procedures, plans, and 
policies for the telecommunications and information 
systems that support national security and emergency 
preparedness. The lES shall meet approximately one 
month before and one month after an NSTAC meeting. 
At additional Working Sessions of the Subcommittee 
of the whole, the lES shall carry out its role as the 
NSTAC’S principal working body. The lES performs 
the following functions: identifies, plans, and defines 


NSTAC issues; strengthens industry and Government 
coordination; examines legislative and regulatory 
issues; oversees network security activities; provides 
feedback on the status of NSTAC recommendations; 
and directs and oversees the work of subordinate 
Groups. The lES shall report to the NSTAC and the 
subordinate Groups shall report to the lES. 

Article II Membership 

Section 1 The members of the NSTAC shall be 

appointed by the President in accordance with the 
provisions of Section 1(a) of Executive Order No. 
12382, dated 13 September 1982. 

Section 2 Each member of the NSTAC shall 

have the authority to appoint one member of the lES. 
The same individual may represent an industry entity 
on the lES and on one or more subordinate Groups. 
Except as provided in Article II, Section 5, the 
membership of the subordinate Groups shall consist 
of lES members elected by the lES for a term of two 
NSTAC cycles. 

Section 3 Only NSTAC entities may be 
represented on the lES or subordinate Groups. 

Section 4 Members of the NSTAC may not 
designate alternates. Members of the lES or any 
subordinate Group may designate an alternate. Such 
designation must be in writing with a copy provided to 
the Office of the Manager, National Communications 
System (OMNCS). An alternate shall have the 
privileges of a member. 

Section 5 Consistent with any applicable security 
clearance requirements, any member of the IBS or his 
or her duly designated alternate may be accompanied 
at any meeting by advisors. Any member or alternate 
may authorize an adviser to speak on behalf of the 
member or alternate. 
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Article III Chair and Voting 

Section 1 The Chair and Vice Chair of the NSTAC 
shall be appointed by the President in accordance 
with the provisions of Section 1(b) of the Executive 
Order No. 12382, dated 13 September 1982. 

Section 2 The Chair of the lES shall be the 
Deputy Manager of the National Communications 
System and not number in the count for a quorum 
nor vote on issues before the lES. At an lES Working 
Session, the lES member from the NSTAC Chair’s 
company shall chair the Working Session. The Chairs 
of subordinate Groups formed by the lES will be 
appointed by the lES Working Session Chair. 

Section 3 A quorum of the Committee, the lES 
or subordinate Group is required to vote on issues 
being addressed. Except as set forth in Section 5, a 
quorum is constituted by the presence of more than 
half of the membership of the Committee, lES or 
subordinate Group. 

Section 4 Only members of the NSTAC, the lES, 
or subordinate Group may vote. All issues will be 
decided, and recommendations or decisions made, 
by a majority vote of those members present at any 
NSTAC, lES, or subordinate Group meeting. 

Section 5 Absent a request for a recorded 
and/or secret ballot vote, all votes shall be by either 
a show of hands or by voice vote. Any member may 
request a recorded and/or secret ballot vote at any 
time. With or without a quorum at a meeting, the 
Chair of the lES or subordinate Group may conduct a 
recorded vote by mail at any time absent objections 
of any member. In the case of a mall vote, a quorum 
is constituted by receipt of votes from more than half 
of the membership. A non-response from an lES or 
subordinate Group member will be considered a vote 
in the affirmative. 


Article IV Minutes and Reports 

Section 1 Committee records will be maintained 
as set forth In the Eederal Advisory Committee Act, 5 
U.S.C. App.2. 

Section 2 A written summary will be prepared 
for each lES meeting and meeting of the lES Working 
Session. Summaries of the meetings will be prepared 
by the OMNCS and forwarded to members of the 
meeting body and other participating entities to 
review for accuracy and completeness. 

Section 3 A consolidated annual report of 
results of all NSTAC activities shall be prepared 
and distributed to all members, and to any Eederal 
Government entity upon request. Other reports shall 
be prepared as directed by the NSTAC. 

Section 4 All reports except minority reports 
shall be prepared by the OMNCS and forwarded to 
the members for review and comment at least 15 
days prior to final distribution. 

Section 5 Minority reports may be prepared 

by any industry member(s) and forwarded to the 
OMNCS. The OMNCS will attach the minority report 
to the majority report. 

Article V Issue Development 

Section 1 Issues for consideration by the NSTAC 
may be suggested by any Government or industry 
entity, or any other person. The OMNCS will prepare 
suggested issues into issue papers for consideration 
by the lES. 

Section 2 The lES will review all issue papers 
and recommend to the NSTAC their approval or 
disapproval for further consideration, or recommend 
such other action as is deemed necessary. For issues 
sent to a subordinate Group for study, analysis and/or 
the development of recommendations or options, the 
lES will provide guidance and direction as necessary. 
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Section 3 Studies, analyses, recommendations, 

or options deveioped by any subordinate Group shail 
be submitted to the lES, by report or briefing, for 
consideration prior to presentation or submission to 
the NSTAC. 

Article VI Amendment of the Bylaws 

Section 1 Amendment of the Bylaws may be 
proposed by any member of the NSTAC at any time. 
Such amendments may be adopted or dismissed 
only by majority vote of the NSTAC. 

Section 2 An amendment to the Bylaws shall 
become effective immediately following its adoption. 
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The President’s National Security Telecommunications 
Advisory Committee Membership (as of May 10,2006) 


Mr. F. Duane Ackerman, NSTAC Chair 

Chairman and CEO 
BellSouth Corporation 

NSTAC Vice Chair 

To Be Determined 

Mr. James F. Aihaugh 

President and CEO 

Boeing Integrated Defense Systems 

The Boeing Company 

Mr. Lawrence T. Bahhio, Jr. 

Vice Chairman and President 
Verizon Communications, Inc. 

Mr. Gregory Q. Brown 

Executive Vice President, President 
Networks and Enterprise 
Motorola, Inc. 

Mr. Kenneth C. Dahiherg 

Chairman and CEO 

Science Applications International 

Corporation 

Mr. Gary D. Forsee 

President and CEO 
Sprint Nextel Corporation 

Mr. Van B. Honeycutt 

Chairman and CEO 
Computer Sciences Corporation 

Mr. Clayton M. Jones 

Chairman, President and CEO 
Rockwell Collins, Inc. 


Mr. Scott G. Kriens 

Chairman and CEO 
Juniper Networks, Inc. 

Mr. Craig 0. McCaw 

Chairman 

Teledesic Corporation 

Mr. Craig J.Mundie 

Chief Research and Strategy Officer 
Microsoft Corporation 

Mr. Richard C. Notehaert 

Chairman and CEO 
Qwest Communications 
International, Inc. 

Mr. Donald J. Dhert 

Group Executive 
Network Computing Group 
Bank of America Corporation 

Mr. Stratton Sclavos 

Chairman, President, and CEO 
Verisign, Inc. 

Mr. Stanley T. Sigman 

President and CEO 

Cingular Wireless EEC 

CTIA - The Wireless Association 

Mr. Randall L. Stephenson 

Chief Operating Officer 
AT&T, Inc. 

Mr. William H. Swanson 

Chairman and CEO 
Raytheon Company 


Mr. Lawrence A. Weinhach 

Chairman 
Unisys Corporation 

Mr. Joseph R. Wright 

CEO 

PanAmSat Corporation 

Position Vacant 

Electronic Data Systems 

Position Vacant 

Lockheed Martin Corporation 

Position Vacant 

Lucent Technologies 

Position Vacant 

Nortel 

Position Vacant 

Northrop Grumman Corporation 

Position Vacant 

United States Telecom Association 
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Executive Report on the 29th Meeting 

of the President’s National Security Telecommunications Advisory 

Committee (NSTAC XXIX) - May 10,2006 


The President’s National Security Telecommunications 
Advisory Committee (NSTAC) held Its 29th meeting 
(NSTAC XXIX) on May 10, 2006, at the Ronald 
Reagan Building and International Trade Center in 
Washington, DC. The meeting, which centered around 
the theme “NSTAC: Enhancing National Security and 
Emergency Preparedness through Communications” 
focused on issues surrounding national security and 
emergency preparedness (NS/EP) communications 
in both this time of heightened security and in 
the aftermath of the 2005 hurricane season. The 
NSTAC Principals met with Mr. George Eoresman, 
Under Secretary for Preparedness, Department 
of Homeland Security (DHS) during the Executive 
Breakfast; met with Vice President Richard Cheney 
and other senior Administration leadership; reviewed 
NSTAC activities over the past cycle and met with 
Mr. Robert Stephan, Acting Assistant Secretary for 
Cyber Security and Telecommunications, Assistant 
Secretary for Infrastructure Protection, and Manager 
of the National Communications System (NCS), 

DHS, Mr. Kenneth Rapuano, Deputy Assistant to 
the President for Homeland Security, Chairman 
Kevin Martin, Eederal Communications Commission 
(ECC), Mr. John Grimes, Assistant Secretary of 
Defense for Networks and Information Integration 
and Chief Information Officer, Department of Defense 
(DOD), and other senior Administration officials during 
the Business Session; met with Dr. John H. Marburger 
III, Science Adviser to the President and Director of 
the Office of Science and Technology Policy (OSTP), 
during the Executive Luncheon; and engaged in 
discussion with Ambassador John Negroponte, 
Director of National Intelligence (DNI), Ambassador 
David Gross, United States (U.S.) Coordinator for 
International Communications and Information Policy 
in the Bureau of Economic and Business Affairs, 
Department of State (DOS), Ms. Kristjen Nielsen, 
Homeland Security Council, Mr. Richard Russell, 
OSTP, Dr. William Luti, National Security Council 


(NSC), and Mr. John Bansemer, NSC, and a number 
of senior Administration officials during the Executive 
Session. This Executive Report summarizes those 
presentations and deliberations. Also attached are 
the recommendations to the President from NSTAC 
XXIX (Attachment 1) and an attendance list of NSTAC 
Principals (Attachment 2). 

NSTAC XXIX Executive Breakfast 

Call to Order/Opening Remarks. 

Mr. E. Duane Ackerman, BellSouth Corporation 
and NSTAC Chair, called to order the 29th NSTAC 
Executive Breakfast on May 10, 2006, at 8:00 a.m. 
at the Ronald Reagan Building and International 
Trade Center in Washington, DC. 

Remarks: Mr. George Foresman. 

Mr. Ackerman introduced Mr. Eoresman. Mr. Eoresman 
thanked the NSTAC Principals for the opportunity 
to meet with them and provided an overview of the 
current state of preparedness. He noted that many of 
the current telecommunications, cyber, infrastructure 
protection, and disaster response issues, such as 
industry access to restoration sites, are the same as 
many of those encountered during Hurricane Andrew 
in 1992. In addition, recognition of the need for better 
public-private sector collaboration during response and 
recovery activities continues to exist. Mr. Eoresman 
emphasized that his goal as the Under Secretary for 
Preparedness Is to ensure that lessons learned during 
emergency situations are not just lessons documented. 
The lessons learned today need to be acted upon In the 
future to improve the Nation’s preparedness posture. 

Mr. Foresman emphasized the importance of the 
Industry-Government partnership found in the NSTAC 
and stated that in his 20 years of Government service, 
he has learned that Government has an obligation 
to ensure that the Committee’s advice and expertise 
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are used in an efficient and effective manner. He 
recognized that the Government is dependent on 
the private sector and must improve its ability to 
clearly articulate its needs to industry. Mr. Foresman 
reminded the group that the DHS was established in 
the aftermath of the September 11, 2001, terrorist 
attacks. Initially, DHS tried to fulfill its mission alone 
without full consideration of the extensive resources 
and knowledge that exists within private industry. Since 
then, the Department has recognized it cannot fulfill its 
mission without the private sector; and for this reason, 
the Government owes constant feedback on what 
industry can do to assist DHS in meeting its mission. 

Mr. Foresman continued by explaining that, as the 
Under Secretary for Preparedness, he is challenged 
to define what Is meant by preparedness. It is 
becoming increasingly important to consider the 
changing culture of preparedness and how to 
incorporate new business models of partnership 
with industry. He added that in the past, the primary 
relationship between industry and Government 
had been one of “regulatee" vs regulator; however, 
recent events challenge the effectiveness of this 
model. In the post-Enron scandal environment, 
corporate America has begun to manage risks 
differently. In addition, the September 11 terrorist 
attacks emphasized the need to ensure that we, 
as a Nation, are safer and more secure. In this 
environment, prevention, protection, response, and 
recovery must be viewed as a continuum constituting 
preparedness. Finally, Hurricane Katrina emphasized 
the need to be prepared not only for terrorist 
attacks but also for natural disasters. Mr. Foresman 
highlighted that lessons learned from all of these 
events can be applied to a broader range of risk 
management. For example, the severe flooding that 
paralyzed much of New Orleans, Louisiana, following 
Hurricane Katrina is illustrative of the situation that 
could result if a location were contaminated for an 
extended period as a result of a chemical attack. 

Mr. Foresman informed the Principals that a 
significant challenge In developing an integrated 
approach to preparedness is the need to consider 
these activities within the larger international relations 


context. Decisions made by the United States 
Government often have significant, sometimes 
negative, impacts abroad. However, at the same 
time, relationships developed through international 
partnerships are essential to implementing effective 
preparedness strategies domestically. 

He further noted that lessons learned from the 
recent events must be effectively integrated into 
preparedness strategies to ensure that future 
generations of leaders benefit from these lessons. 

He expressed disappointment that the lessons 
learned from Hurricane Katrina were identical to 
approximately 70 percent of the lessons learned 
previously from Hurricane Andrew. Mr. Foresman 
underscored the fundamental obligation to ensure 
that tangible improvements are made so a culture of 
preparedness can be created. 

Although the Hurricane Katrina response activities 
yielded numerous lessons learned, Mr. Foresman 
noted that there were several success stories. A 
wide range of resources were deployed on the 
ground, helping to save more than 60,000 people 
and to evacuate 1.2 million people from the disaster 
area. He thanked the industry members present 
for their contributions to these efforts. In closing, 

Mr. Foresman reemphasized the need to be better 
prepared for the next emergency or disaster and to 
identify the best business model for preparedness. 

Closing Remarks/Adjournment. 

Mr. Ackerman thanked the Principals and 

Mr. Foresman for their participation and adjourned 

the Executive Breakfast at 9:00 a.m. 
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NSTAC XXIX Business Session 

Call to Order/Opening Remarks. 

Mr. Ackerman called to order the 29th NSTAC 
Business Session on May 10, 2006, at 11:00 a.m. at 
the Ronald Reagan Building and International Trade 
Center In Washington, DC. 

Mr. Ackerman welcomed members of the NSTAC 
and recognized the senior Government officials 
participating In the Business Session: 

► Mr. Rapuano; 

► Chairman Martin; 

► Mr. Grimes; 

► Mr. Stephan; and 

► Ambassador Gross. 

Mr. Ackerman thanked all those In attendance who 
contributed to the work of the NSTAC over the past 
year and specifically noted that the strength of the 
partnership among the Industry and Government 
participants at the meeting table has enabled 
the NSTAC to develop timely and responsive 
recommendations. He added that over the past year, 
the NSTAC has effectively adapted and responded to 
emerging and developing threats with an appropriate 
sense of their urgency. The annual meeting presents 
an opportunity to review the progress made over the 
preceding year and to set the stage for the coming year 
of work. Hurricane Katrina seriously tested the Nation’s 
capabilities and taught hard lessons, particularly 
regarding interdependencies. Preparation efforts for 
next year must respond to those lessons learned. 

To best enable those preparations, Mr. Ackerman 
encouraged all members to provide their input on the 
work of the coming cycle. 

Remarks: Mr. Kenneth Rapuano. 

Mr. Rapuano thanked the members for the 
opportunity to address the NSTAC. He relayed the 
regrets of Ms. Frances Fragos Townsend, Assistant 
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to the President for Homeland Security and 
Counterterrorism, who was unable to attend due to 
her participation in the 2006 Governor’s Hurricane 
Conference in Florida. He thanked Mr. Ackerman 
for his service to date and for agreeing to chair the 
NSTAC for another year. Mr. Rapuano also thanked 
the NSTAC members for their service on behalf of 
the President, noting how much the President relies 
on the Committee’s advice. 

Mr. Rapuano reiterated the extent of the destruction 
that the 2005 hurricanes wrought on the 
telecommunications infrastructure. The storms 
overwhelmed emergency services, causing response 
efforts to tall short of expectations. As a result. President 
George Bush directed Ms. Townsend to study strategies 
to improve future response efforts. The resulting 
White House report. The Federal Response to Hurricane 
Katrina: Lessons Learned, identified numerous challenges 
for ensuring the operability and interoperability of 
communications networks during all possible hazards 
and highlighted the need specifically for deployable 
communications capabilities. 

Mr. Rapuano noted that the White House is particularly 
interested in understanding and developing strategies 
for using deployable capabilities, such as mobile 
bridges, satellite technology, and Voice over Internet 
Protocol, to gather situational awareness information 
during disaster response and recovery activities. 

He further noted that recent NSTAC letters and 
reports offered valuable recommendations regarding 
emergency communications, and that White House 
officials will continue to rely on the NSTAC for advice 
and input to augment the concepts included in 
the draft National Emergency Communications Strategy. In 
particular, Mr. Rapuano noted that the White House 
is interested in better understanding those challenges 
industry foresees in the implementation of deployable, 
reliable communications. He specifically requested 
insight on the commitments the Federal Government 
can expect from industry with regard to finalizing the 
National Emergency Communications Strategy and offer!ng 
solutions for the implementation of a deployable 
communications capability, as recommended by 
the NSTAC. 
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Finally, Mr. Rapuano commended the NSTAC on 
its recommendations in the area of next generation 
networks (NGN), indicating that the White Flouse 
found the advice to be of great value. He noted the 
long-term evolution of the communications network 
and emphasized the need for a similar long-term 
approach for Industry-Government collaboration 
in this area. 

Remarks: Mr. Robert Stephan. 

Mr. Stephan thanked the NSTAC members for their 
efforts over the past year, noting the more than 
20-year history of successful Industry-Government 
collaboration represented by the members around 
the table. He praised Mr. Ackerman’s direction 
and leadership and the NSTAC’s work to address 
many of the complex problems facing the Nation, 
particularly in the areas of the NGN, infrastructure 
interdependencies, and coordination. He noted 
the incredible challenges that the preceding year 
had presented, including the July 2005 London 
bombings; hurricanes Katrina, Rita, and Wilma; 
and the Congressional hearings, and the very timely 
production of the NSTAC’s work this year with regard 
to those challenges. Terrorism, natural disasters, 
and industrial accidents are all examples of the wide 
range of threats the homeland faces and against 
which the DHS must remain vigilant on a daily 
basis. He observed that the Executive Office of the 
President is conducting very important work on how 
to address NS/EP and crisis communications issues 
into the future. 

Mr. Stephan remarked that the NSTAC has remained 
a valuable partner in protecting the Nation from 
such threafs through its participation in several 
key DHS efforts. Specifically, the NSTAC member 
companies engaged in efforts to strengthen the 
National Infrastructure Protection Plan, resulting in 
significant, yet beneficial, changes to the base plan. 
DHS continues to seek industry input on the Sector 
Specific Plans (SSP) associated with the base plan, 
particularly those for Information Technology (IT) 
and Communications. He commented that the 


Department appreciates the input from industry 
received to date and looks forward to additional 
feedback as the SSPs are refined. 

In addition, the NSTAC provided significant value In 
helping to integrate lessons learned from Hurricane 
Katrina into Eederal plans for addressing future 
challenges from an all hazards approach. He praised 
the member companies for their work with Eederal, 
State, and local Government entities to develop an 
access standard operating procedure (SOP) to ensure 
that private critical infrastructure responders have 
priority access to disaster areas. The access SOP 
has been adopted by the State of Georgia and is 
currently being used as an example for other states. 
Furthermore, NSTAC members collaborated with the 
NCS to develop a process known as the Emergency 
Wireless Protocol for determining if and when cellular 
network connections should be terminated in an 
emergency such as the London bombings. Einally, 

Mr. Stephan highlighted the importance of industry 
participation in exercises and informed the Principals 
that DHS is working with RAND to host a private 
sector tabletop exercise to consider the issues, 
protocols, and legal concerns associated with disaster 
response and recovery efforts in the future. He noted 
that the exercise will incorporate the lessons learned 
identified by the NSTAC with regard to the varied 
interpretations of the Robert T. Stafford Disaster Relief 
and Emergency Assistance (Stafford) Act during Hurricane 
Katrina. Mr. Stephan concluded his remarks by 
emphasizing the need for industry and Government 
to work as a team to defeat the Nation’s adversaries. 

Remarks: Chairman Kevin Martin. 

Chairman Martin commended the NSTAC member 
companies on their enormous efforts to reestablish 
communications in the Gulf Coast region after the 
2005 hurricanes, and the NSTAC as a whole on 
the recommendations produced to help prepare 
the Nation for the 2006 hurricane season. He 
noted that the FCC has carefully considered the 
NSTAC recommendations on the restoration of 
communications, especially the concerns related to 
access and credentlaling. 
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Chairman Martin encouraged the NSTAC Principals 
to focus future efforts on three areas—strategies to 
seamlessly integrate commercial equipment and 
first responder networks, development of a tool 
kit to ensure more resilient and rapidly deployable 
communications capabilities, and ways to more fully 
integrate industry response efforts with Government 
leadership at the State level. He offered his thanks to 
the NSTAC members for their valuable work thus far 
toward those ends. 

Remarks: Mr. John Grimes. 

As a founding member of the NSTAC, Mr. Grimes 
offered his insights on the value of the NSTAC 
symbolized by its 20 year longevity in a constantly 
changing communications network and security 
context. He identified three key drivers that define 
the partnership in this day and age: (1) the way 
in which the issues the Nation faced in the Cold 
War have evolved to today’s terrorism-centric 
domestic threat; (2) the importance of Presidential 
involvement; and (3) the operational activities of the 
National Coordinating Center (NCC). 

Mr. Grimes informed the NSTAC Principals that DOD 
will become more involved in domestic emergency 
response activities. While the Department has always 
played a role In emergency situations; that role 
will intensify with the appropriate divisions taking 
immediate action in response to major events such as 
Hurricane Katrina. Finally, Mr. Grimes recalled how the 
NSTAC process began In the wake of the divestiture of 
AT&T to ensure that industry involvement in protecting 
the Nation’s communications capabilities would endure 
within a competitive operating environment, and 
emphasized the continued importance of the process 
in the evolving communications market environment. 

Mr. Ackerman thanked the senior Government 
officials for their remarks and attendance at the 
NSTAC XXIX Meeting. He then recognized the newly 
appointed NSTAC Principal, Mr. Scott Kriens of 
Juniper Networks, Inc., and the two pending NSTAC 
Principals, Mr. Walter McCormick of the United 
States Telecom Association and Mr. Arthur Johnson 
of Lockheed Martin Corporation. Mr. Ackerman 
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welcomed the new Principals and stated that their 
NSTAC colleagues looked forward to working with 
them in the coming cycle. 

Ongoing NSTAC Work. 

Mr. Ackerman turned the discussions to a review of 
the NSTAC’s ongoing work efforts. He thanked the 
Industry Executive Subcommittee (lES) members 
for their significant work over the past cycle. At the 
beginning of the NSTAC XXIX cycle, there were five 
existing task forces: (1) the Next Generation Networks 
Task Eorce; (2) the National Coordinating Center Task 
Force (NCCTF); (3) the Research and Development 
(R&D) Task Force; (4) the Legislative and Regulatory 
Task Force (LRTF); and (5) the NSTAC Outreach Task 
Force. During the course of the cycle, the NSTAC 
formed the Telecommunications and Electric Power 
Interdependency Task Eorce and the Emergency 
Communications and Interoperability Task Eorce 
(ECITF). Mr. Ackerman thanked the NSTAC Principals 
who championed these task forces for their extensive 
insight and leadership: Mr. Craig Mundie, Microsoft 
Corporation; Ms. Patricia Russo, Lucent Technologies; 
Mr. Gregory Brown, Motorola, Inc.; Mr. Joseph Wright, 
PanAmSat Corporation; Mr. Lawrence Babble, Verizon 
Communications, Inc.; Mr. Van Honeycutt, Computer 
Sciences Corporation; and Ms. Susan Spradley, Nortel. 

Emergency Communications and Interoperabiiity Task Force. 

Mr. Brown, ECITE Champion, provided the Principals 
with an update on the task force’s recent efforts. At 
the December 8, 2005, NSTAC Principals’ Hurricane 
Katrina Response Working Group Meeting, members 
discussed the lack of network operability and 
effective management processes which hindered the 
overall management of the response activities. He 
emphasized the need for both network operability and 
interoperability between the communications networks 
used by the responder community in the future, 
noting that without the capability to communicate, 
response efforts would be continually challenged. 

He reviewed that the Committee established the ECITF 
in February 2006 for two purposes: (1) to provide 
recommendations to the President on short-term 
interoperability solutions for responders in advance 
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of the 2006 hurricane season; and (2) to provide 
mid- to long-term recommendations addressing how 
a complete suite of communications technologies 
should be integrated into the Federal Government’s 
emergency communications planning, and how they 
could more effectively support NS/EP activities. In 
response to this tasking, the ECITF drafted a letter to 
the President that outlines emergency communications 
and interoperability issues and identifies 
immediately applicable actions to improve responder 
communications capabilities. Specifically, the letter 
recommends the establishment of a uniform protocol 
for identifying emergency management coordinators' 
contact information, the creation of a deployable 
communications capability, the Integration of the 
NCS NS/EP priority services programs into the National 
Emergency Communications Strategy, and the establishment 
of cooperative efforts between the National 
Telecommunications and Information Administration 
and the FCC to streamline the authorization process for 
use of Federal incident response frequencies. 

The Principals formally approved the letter on the 
March 28, 2006, NSTAC Principals’ Conference Call. 

Mr. Brown also commented that the February 2006 
White Flouse Lessons Learned Report recommends the 
development of a National Emergency Communications 
Strategy tUat supports communications operability 
and interoperability, and takes into consideration 
the direction of the telecommunications industry 
and the supporting recommendations of the NSTAC. 
Mr. Brown noted that the NSTAC fully endorses the 
development of such a strategy and is committed 
to help in its development. Specifically, Mr. Brown 
noted the importance of ensuring that the strategy 
addresses all-hazards risks and the need to optimize 
existing capabilities and calls for the seamless 
integration of first responder and commercial 
communications capabilities. 

Mr. Ackerman thanked Mr. Brown for his update and 
emphasized that the work of the ECITF will continue 
to be a top priority in the next cycle. 


Legislative and Regulatory Task Force. 

Mr. Ackerman reported that throughout the 
past cycle, the LRTF continued to analyze 
legislative and regulatory Issues relevant to NS/EP 
telecommunications, especially as they related to 
Hurricane Katrina response and recovery efforts. 
Following the Decembers, 2005, NSTAC Principals’ 
Hurricane Katrina Response Working Group Meeting, 
the LRTF drafted a letter and report, EederalSupport 
to Telecommunications Infrastructure Providers in National 
Emergencies, Designation as “Emergency Responders 
(PrivateSector),” recommending the designation of 
telecommunications infrastructure providers as 
“Emergency Responders (Private Sector)” and 
providing them with access to non-monetary Federal 
assistance, such as fuel, water, and security, for 
industry telecommunications response personnel. 
Furthermore, the letter and report recommend the 
issuance of appropriate Presidential guidance to 
define “Emergency Responders (Private Sector)” 
under the Stafford Act and other authorities, as 
appropriate, to align with the broadened definition 
of national defense in the 2003 amendments to 
the Defense Production Act of 1950. Lastly, the letter and 
report recommend that the Secretary of Homeland 
Security work with the Congress to codify the official 
“Emergency Responder (Private Sector)” term and 
Interpretation that for-profit telecommunications 
infrastructure providers should receive Federal 
assistance under the Stafford Act and other appropriate 
legislative authorities. The letter and report received 
Principal approval during the January 31, 2006, 
NSTAC Principals’ Conference Call. 

Mr. Ackerman furfher reporfed that the LRTF 
completed a report to the NSTAC Principals on open 
source information on academic Web sites and 
examined NS/EP legislative and regulatory issues as 
they arose throughout the cycle. 

National Coordinating Center Task Force. 

Mr. Babbio, NCCTF Champion, reminded the 
Principals that the task force was established to study 
the direction of the NCC over the next year, three 
years, and five years, and to specifically address: 

(1) how industry members of the NCC should 
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continue to partner with Government; (2) how the 
NCC should be structured; and (3) how the new DHS 
Sector Coordinating Council (SCC) approach could 
aftect the NCC. He noted that the task force recently 
completed its draft report and recommendations 
for Principal review and commended the task force 
members for completing such an important document 
in the midst of Katrina response activities. He thanked 
Mr. James Bean, Verizon Communications, Inc., and 
NCCTF Chair, and Mr. John Stogoski, Sprint Nextel 
Corporation and NCCTF Vice Chair, as well as all 
participants for their hard work and dedication. 

Mr. Babbio highlighted several key tindlngs in the 
report, first discussing the need to dispel the artificial 
separation of the telecommunications and IT sectors. 
The report recommends that this issue be addressed 
through a merger of the NCC and the IT Information 
Sharing and Analysis Center over the next several 
years. Mr. Babbio also noted the report recommends 
the need to improve Industry-Government coordination 
at the regional level; to increase industry participation 
in Government planning, training, and exercises; 
to improve information sharing among industry 
members of the NCC as well as between industry and 
Government; and to include Industry In Government 
impact analyses from the earliest stages to provide for 
the best possible outcome. 

Mr. Babbio noted that the NSTAC completed a 
letter to the President, which received Principal 
approval during the March 28, 2006, NSTAC 
Principals’ Conference Call, urging that a task force 
be convened to design a regional communications 
coordinating capability. He noted that this task force 
has been convened by the Communications SCC 
and work is currently underway. Mr. Babbio further 
informed the Principals that the NCCTF Report 
includes a Roadmap for the NCC's Future, outlining 
more than 60 actions for the next one, three, and 
five years that will better prepare the NCC to meet 
upcoming challenges. 
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The NSTAC Principals unanimously voted to approve 
the NCCTF Report. 

Closing Remarks/Adjournment. 

Mr. Ackerman recognized the lES members for all 
of their efforts during the cycle. He thanked the 
Principals and speakers for their participation in the 
morning’s proceedings. Ambassador Gross remarked 
that he looked forward to the afternoon discussions 
regarding the international implications of the NGN. 
Mr. Ackerman adjourned the NSTAC Business 
Session at 11:50 a.m. 
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NSTAC XXIX Executive Luncheon 

Call to Order/Opening Remarks. 

Mr. Ackerman called to order the 29th NSTAC 
Executive Luncheon on May 10, 2006, at 12:00 p.m. 
at the Ronald Reagan Building and International 
Trade Center in Washington, DC. Mr. Ackerman 
introduced Dr. Marburgerto present the new 
member certificate and to offer brief remarks to 
the Principals on the importance of innovation 
to the Nation’s economic and technological 
competitiveness. 

Certificate Presentation. 

Dr. Marburger called Mr. Kriens forward to receive his 
certificate. Mr. Kriens rose and accepted his certificate. 

Remarks: Dr. John Marburger. 

Dr. Marburger commended the Principals for 
participating on one of the Federal Government’s 
most important advisory bodies. He noted that the 
member companies of the NSTAC possess the most 
accurate knowledge of the vulnerabilities facing the 
communications networks as well as the complexities of 
the networks’ infrastructure, key pieces of information 
that the Government must better understand to 
effectively conduct Its varied missions. He asked the 
members to continue to work in partnership with the 
Government, advising them as necessary on those 
issues of which they must be aware. 

Dr. Marburger remarked that President Bush 
recently announced, in his State of the Union 
speech on January 31, 2006, the establishment of 
the American Competitiveness Initiative (ACI)—a Federal 
effort to continue to maintain the Nation’s economic 
competitiveness and leadership in science and 
technology through innovation. He noted that the 
Administration recognized the importance of investing 
in the future, particularly in the areas of IT, which has 
formed the foundation for many of the business plans 
developed by private Industry, and workforce training, 
the key to producing the technology platforms needed 
to compete in the future global marketplace. He 
observed that the concepts underpinning the purpose 
of the Initiative were highlighted in three reports 


developed by the President’s Council of Advisors on 
Science and Technology in 2003 and 2004 as well as 
the NSTAC. In addition, the National Academies has 
developed a list of twenty innovative areas for further 
R&D investment. 

Dr. Marburger observed that since the end of 
the Cold War, the Federal Government has “flat 
funded” the key agencies responsible for conducting 
R&D activities. To counteract this trend, the ACI 
commits $5.9 billion in fiscal year 2007 to increase 
investments in R&D, strengthen education, and 
encourage entrepreneurship. Over 10 years, the 
Initiative commits $50 billion to increase funding for 
research and $86 billion for R&D tax incentives. The 
majority of the funding will be provided to three key 
research agencies—the Department of Commerce’s 
National Institute for Standards and Technology, the 
National Science Foundation, and the Department of 
Energy’s Office of Science—to focus on issues that 
serve long-term competitiveness goals. Furthermore, 
he acknowledged that the President favors the 
Institution of a permanent tax credit for research and 
is investigating methods for making the tax credit 
available to a larger number of companies In the 
R&D community, particularly smaller entitles. 

Dr. Marburger concluded his remarks by announcing 
that significant sections of the ACI reflect the need to 
undertake additional training and education activities. 
He specifically noted consideration of the extension 
of the Pell Grants system and efforts to redirect 
science and technology assets to enrich K-12 math 
and science education by enhancing understanding 
of how students learn and applying that knowledge to 
train highly qualified teachers. Dr. Marburger thanked 
the Principals for their continued dedication to the 
NSTAC and welcomed their further attention to R&D 
issues in the future. 

Closing Remarks/Adjournment 

Mr. Ackerman thanked the Principals and speakers 
for their participation and adjourned the Executive 
Luncheon at 12:45 p.m. 
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NSTAC XXIX Executive Session 
Opening Remarks. 

Mr. Ackerman called to order the 29th NSTAC 
Executive Session at the Ronald Reagan Building 
and International Trade Center In Washington, DC, 
on May 10, 2006, at 1:00 p.m. 

Mr. Ackerman explained that the NSTAC Executive 
Session would provide the NSTAC Principals, along 
with the senior Government officials in attendance, 
the opportunity to discuss and refine the key issues 
for the NSTAC XXX work plan. Before commencing 
the Executive Session discussion, Mr. Ackerman 
introduced the Government stakeholders who joined 
the meeting for the session: 

► Ambassador Negroponte; 

► Mr. Bansemer; 

► Dr. Luti; 

► Ms. Nielsen; 

► Mr. Russell; and 

► Ambassador Gross. 

International Implications of Next Generation Networks. 

Mr. Stratton Sclavos, VeriSign, Inc., led the discussion 
on the international Implications of the NGN. He noted 
that the NGNTE briefly delved into issues related to the 
global nature of the NGN and determined that these 
issues required further examination by the NSTAC. 

He noted that the lES established a scoping group to 
address international issues following the discussion at 
the NSTAC XXVIII Meeting last year, and suggested that 
the Principals activate the scoping group as a follow on 
task to that completed by the NGNTE. He turther noted 
that several NSTAC companies have encountered 
repeated denial-of-service attacks of significant impact 
since January 2006 thereby increasing the importance 
of the international issues for many of those companies 
at the table at this time. Further investigations revealed 
that the attacks originated from China, Eastern Europe, 
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and the U.S. Mr. Sclavos warned that there is a risk 
that such attacks could be carried out on an even 
larger scale, and such a threat is illustrative of the 
critical need to extend the Nation’s NS/EP cyber 
posture internationally. 

Commenting on the interconnected nature of the 
NGN, Ambassador Gross noted that the evolution of 
the communications network is an important issue 
for the DOS. Although extensive work is underway 
domestically, the U.S. Is not a leader in this area 
technically and has not assumed a leadership role 
In NGN standards development. He informed the 
group that the Governments in Korea, China, Japan, 
and Europe are all expending signiticant resources, 
both financial and human, to advance the evolution 
of the network. He added that there are numerous 
security issues that must be addressed with the 
further development of NGN standards globally and 
that DOS stands ready to assist the private sector In 
any way with this effort. Mr. Bansemer emphasized 
the importance of considering not only the security 
concerns related to standards development, but 
also the Importance of International outreach in 
response activities. He noted that DHS’ National 
Cyber Security Division is engaged with international 
partners to discuss response efforts. Furthermore, 
the Global IT Working Group is preparing a report on 
communications in the global marketplace from the 
Government's perspective which outlines significant 
network security implications posed by globalization. 

The Principals agreed that the scoping group should 
begin work first by reviewing the NGNTE Report 
and determining which of the recommendations 
that are of an international nature warrant further 
Investigation. Mr. Sclavos suggested that to draw 
conclusions about best practices, the International 
Scoping Group should also consider cataloguing 
current international assets used by public-private 
partnerships to better understand existing Computer 
Emergency Readiness Teams-like capabilities and 
private information sharing mechanisms. He further 
added that the scoping group should consider 
the appropriate rules of engagement related to 
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international incident response and should examine 
the nature of cyber incidents and the appropriate 
domestic and international response mechanisms. 

A Principal commented that much of the effort to 
standardize the NGN will be borne by Industry; and 
the scoping group should Instead focus its efforts 
on investigating operational issues. Ambassador 
Gross agreed to the importance of operational issues 
but noted that standardization is a key global issue 
that should be considered from the perspective of 
whether it is better to maintain a single system that 
adheres to a universal operational standard or to 
have numerous separate, but interoperable, systems 
that are less likely to be attacked. A member further 
suggested that should standards be addressed, the 
group consider those associated with the federation 
of identity management and authentication of foreign 
persons who must communicate with the U.S. 
Government during incidents. A Principal proposed 
that the group also explore the international 
implications of the deployment of Internet Protocol 
version 6 (IPv6), as well as Multi Protocol Label 
Switching deployment, noting that the U.S. is falling 
behind in the deployment of IPv6. Mr. Ackerman 
suggested that it may be necessary to resurrect the 
NGNTF to further explore the IPv6 issue. 

Remarks: Ambassador Negroponte 

Ambassador Negroponte thanked the NSTAC 
Principals for the opportunity to meet with them and 
proceeded to provide an overview of his priorities as 
DNI. He described his three key areas of focus as: 

(1) improving the quality of analysis; (2) building a 
sense of community; and (3) using limited resources 
effectively. 

With regard to improving the quality of analysis. 
Ambassador Negroponte noted that in the post-9/11 
environment, many safeguards have been put in 
place to ensure that past mistakes are not repeated. 
In addition, as DNI, he is emphasizing the use of 
alternative analysis techniques—the practice of 
analyzing factual information to reach conclusions 
different from conventional wisdom. He is also 
creating an analytical resources catalogue, gathering 


input from across the intelligence community on key 
analyses, and emphasizing the need to constantly 
challenge assumptions. 

Ambassador Negroponte informed the Principals 
that each of the 16 elements of the intelligence 
community has different strengths which must be 
pulled together to form one cohesive community. 
Specifically, he emphasized the need to ensure not 
just vertical movement, but horizontal movement, 
of intelligence information. To reach this goal of a 
true community, consideration is being given to the 
development of a plan, similar to that prescribed in 
the Goldwater-Nichols Department of Defense Reorganization 
Act of 1986, which required military officers to work at 
a joint command—working closely with other military 
branches—to be promoted beyond a certain level. 
Ambassador Negroponte informed the Principals 
that he envisions a similar program In the intelligence 
community that would require senior intelligence 
officers to spend a certain amount of time working 
for another agency. The benefits of such a program 
will take years to be realized but will be critical to 
Improving the sense of community. 

Ambassador Negroponte then emphasized the 
importance of ensuring that limited intelligence 
resources are used effectively and wisely. He noted 
that although the intelligence budget is classified, 
it is fairly substantial, and efforts are underway to 
ensure that it is wisely spent. Mr. Ackerman inquired 
regarding the process for sharing intelligence 
information with those members of the private sector 
with critical infrastructure protection responsibilities. 
Ambassador Negroponte informed the Principals 
that the Office of the DNI does not have a statutory 
responsibility for sharing threat information with 
State and local authorities, or by extension with the 
private sector. He noted, however, that there are 
mechanisms through the DHS, the Federal Bureau 
of Investigation, and State and local Governments 
for sharing information with industry. He further 
emphasized that threats are typically too general 
and too vague to be actionable. However, if specific 
threat information is received, a mechanism would be 
found to share it with the private sector. Ambassador 
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Negroponte further stated that currently the biggest 
threat from Al-Qaeda and its affiliates appears to be 
to our interests abroad. In response to an inquiry 
regarding the risks posed by industrial espionage, 
Ambassador Negroponte stated that although 
industrial espionage is a priority concern, the threat 
from terrorism is currently a higher priority risk. 

In addition, although the major threat of industrial 
espionage appears to come from a few countries, 
there is a challenge inherent to tracking the activities 
of countries that send thousands of students to the 
U.S. each year. 

Finally, a member inquired regarding steps industry 
could take to assist in improving the intelligence 
community’s ability to transmit highly sensitive 
information. Ambassador Negroponte noted that the 
U.S. still has a technological advantage that must be 
maintained in the future. Fie emphasized that R&D 
are critical to ensuring that the Government is able to 
conduct secure operations over the communications 
network within the current globalizing environment. 

Emergency Communications and Interoperabiiity. 

Mr. Brown, ECITF Champion, continued the 
morning's discussion on emergency communications 
and interoperability and the need to establish a 
survivable and operable emergency communications 
infrastructure for the public safety community. Fie 
emphasized the need to consider the lessons learned 
from Flurricane Katrina in the deliberations of the 
task force, the need for the establishment of a rapidly 
deployable communications capability that offers a 
range of functionality, the establishment of a process 
for improved coordination with key public safety 
officials, and the need for improved training. 

Mr. Stephan highlighted the complexity of the 
interoperability challenge and requested industry 
assistance in the development of the National 
Emergency Communications Strategy, noting a lack of 
broad industry input to the current draft document. 
Fie further noted that the document outlines an 
overarching technical architecture to be established, 
but the Government would value the additional 
insights that the NSTAC could offer. Fie cautioned, 
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however, that Government stakeholders involved in 
the Strategy’s development have “fast tracked” the 
document requiring input from the NSTAC on an 
expedited schedule. Mr. Stephan further noted that 
once the technical framework for the emergency 
communications architecture has been agreed upon, 
the Government will need to implement incentives to 
ensure that interested parties purchase the solution. 
Fie suggested that the Federal Grants Program could 
be utilized to encourage purchase of the solution 
instead of mandating compliance. 

The Principals then discussed and agreed on the need 
to seamlessly integrate commercial and public safety 
emergency response networks as raised by Chairman 
Martin during the NSTAC 29 Business Session. 

The Principals agreed that an inventory of current 
emergency communications assets be developed 
including satellite technologies. Such an inventory 
would build knowledge of existing capabilities and 
could be used to help inform the national strategy. 

Mr. Grimes informed the Principals that the NCS has 
already undertaken such an effort which could form 
the foundation for future activities undertaken by 
the NSTAC. In addition, several members noted that 
the NCC may already possess a current inventory of 
emergency communications capabilities. 

In response to a question from the Principals 
regarding additional areas of support from the 
NSTAC to the Government, Ms. Nielsen informed 
the Principals that DFIS maintains a tactical 
emergency communications plan and regularly 
conducts full-scale exercises. She encouraged 
NSTAC participation in these exercises. In addition, 
she encouraged NSTAC input on the Department’s 
National Preparedness Goal. The Principals agreed 
that the NSTAC should coordinate with Mr. Stephan 
to review both existing and developing Federal plans 
for emergency communications and interoperability. 
In particular, the NSTAC should provide input to the 
National Emergency Communications Strategy. 

Mr. Brown concluded the discussion with an 
overview of the scope of work, including NSTAC’s 
plan to review the following: (1) the National Emergency 
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Communications Strategy; (2) current procedural and 
jurisdictional concerns regarding operability and 
interoperability; (3) the NCS’ current inventory of 
emergency communications technologies to ensure 
that all relevant assets are included; (4) the need 
for the development of short-term operability and 
interoperability solutions; (5) the progress of standards 
development and the need for inventory of current 
operability and interoperability solutions; and 
(6) the NSTAC’s role in the recommended pilot 
program for deployable communications capabilities. 
Mr. Ackerman thanked Mr. Brown and the group for 
their participation in this discussion. 

Regional Coordination, Planning, and Exercises. 

Mr. Stephan discussed lessons learned from the 
2005 hurricane season and changes DHS has 
already initiated or intends to make. He informed 
the group that DHS is actively providing training for 
Federal response teams, hosting a week-long intense 
leadership training program for responders in each 
region, including Federal Emergency Management 
Agency officials, and will engage the participants in 
tabletop exercises. He noted that there Is additional 
room in these exercises for industry participation. 

Mr. Stephan reported that, in coordination with the 
1-year anniversary of the publication of the National 
Response Plan (NRP), the Secretary of Homeland 
Security is performing a comprehensive review of 
the NRP and its Emergency Support Function (ESF) 
Annexes. The ESF#2, Communications, Annex is 
being modified to incorporate lessons learned from 
Hurricane Katrina, and the NCS is currently revising 
the ESF#2 Operations Plan. In a related effort, DHS 
is restructuring its ESF#2 training and exercise 
programs, and in May 2006, the NCS will take part 
in a large-scale ESF#2 exercise. Throughout the 
exercise, the ESF#2 community will test standard 
operating procedures in response to a real-world 
scenario and determine how information sharing 
requirements can be clearly communicated and 
effectively met during an emergency situation. 

In addition, senior officials will be in place at all 
the Joint Field Offices (JFO) to make decisions in 
situations where prepared plans are insufficient. 


Mr. Stephan remarked that DHS has investigated 
codifying a more user-friendly Interpretation of 
the Stafford Act. The new Interpretation of the 
Stafford Act wWl allow the Federal Government to 
give greater assistance to the private sector in 
response and restoration activities, and will be 
clearly communicated and exercised. The clarified 
interpretation enables Federal assistance to the 
private sector, once the requestor has ensured that 
all other means of meeting the assistance needs have 
been exhausted and that the Government has the 
capability to meet the requested needs. The agreed- 
upon interpretation essentially prescribes a metric 
that industry requests must pass to obtain Federal 
assistance. Mr. Stephan asked the Principals to keep 
In mind that catastrophic events such as Hurricane 
Katrina create a resource-scarce environment for 
both industry and Government. Mr. Ackerman asked 
Mr. Stephan about DHS’ plans for the NCC and 
whether industry should continue to Interface with the 
NCC. Mr. Stephan emphasized that DHS will continue 
to use the NCC but added that some requests for 
assistance might come through the JFO initially. He 
stated that the Government will make sure that those 
requests are also sent to the NCC. 

Mr. Stephan also reported that DHS had reached a final 
agreement with the State of Georgia to adopt the access 
pilot to ensure that private critical infrastructure service 
providers receive priority access to disaster sites. This 
pilot is now being used as an example for other States, 
and the State of Georgia, in conjunction with industry, 
is actively encouraging the Gulf States, Including 
Louisiana, Mississippi, Alabama, and Texas, to adopt it. 

Mr. Stephan commented that personal connections 
are extremely important in an emergency response 
situation. Members of the DHS protective security 
unit already have robust personal relationships with 
State and local officials as well as the private sector. 
However, during future events, the Department plans 
to position high-level officials at each JFO, conduct 
dally telephone calls with the NCC, and hold daily 
strategic senior-level conferences. 
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Mr. Ackerman thanked Mr. Stephan for his responsive 
update and noted that the NSTAC wiil pian to review 
the current Federal efforts for regional response 
Improvements, planning, training, and exercises to 
ensure that nothing is being omitted in this area. 

Additional Issues for Discussion. 

Mr. Don Obert, Bank of America Corporation, 
provided the Principais with an overview of the 
results of the National Diversity Assurance Initiative 
(NDAI) study, a follow-up to a recommendation in 
the NSTAC’s Financial Services Task Force (FSTF) 
Report. Following the September 11, 2001, terrorist 
attacks, diversity assurance was identified as a key 
issue across the financial services industry. The 
final NSTAC FSTF Report called for support of the 
Alliance for Telecommunications Industry Solutions’ 
NDAI and the development of processes to examine 
diversity assurance capabilities, requirements, and 
best practices for critical NS/EP customers. The 
report further recommends that R&D be promoted to 
increase resiliency, circuit diversity, and alternative 
transport mechanisms. 

The NDAI concluded that: (1) it is not currently 
possible to guarantee that circuits are diverse 
and will remain diverse overtime unless manual 
assessment and periodic manual assurances are 
performed; (2) assessing telecommunications 
circuits is a very labor- and cost-intensive process 
and currently can only be conducted manually; 

(3) circuit diversity assurance cannot be offered as 
a commercially viable product—only organizations 
with life-safety missions and critical business needs 
may be able to justify the expense of manual circuit 
diversity assurance; (4) an automated solution 
to track circuits across multiple carriers would 
streamline the process for diversity assessment 
and assurance; and (5) the carriers believe that 
the marketplace to support requirements of NS/EP 
functions on a wide-scale basis is insufficient to 
recover costs if the only source is the users of the 
service; external funding is required. 
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The NDAI recommends that: (1) other industries 
with critical missions and circuits evaluate current 
risks with regard to telecommunications continuity 
and take the necessary steps to mitigate those risks; 
(2) the lessons learned from the initiative should 
provide information and terminology that could be 
used by organizations supporting critical NS/EP 
services to better understand the telecommunications 
infrastructure supporting their business needs in a 
multiple carrier environment; and (3) follow-up efforts 
should be undertaken to define the requirements 
for providing an automated end-to-end diversity 
assurance solution in a multiple-carrier environment. 
Mr. Ackerman thanked Mr. Obert for the update 
on actions undertaken in response to the NSTAC’s 
recommendation, noting that information on the status 
of all the recommendations is important. 

Finally, a member suggested that the lES conduct 
an assessment of the current NSTAC agenda to 
determine whether the NSTAC is addressing the 
right issues for both the current and future NS/EP 
communications environment. Mr. Ackerman 
thanked him for his suggestion, commenting that 
continual re-evaluation of the agenda to ensure 
timeliness is essential. 

Adjournment. 

Mr. Ackerman thanked the Principals and the 
Government stakeholders for their participation and 
adjourned the NSTAC Executive Session at 3:15 p.m. 
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Attachment 1: Report Recommendations to the President from the 
29th Meeting of the President’s National Security Telecommunications 
Advisory Committee (NSTAC XXIX) - May 10,2006 


The President’s National Security Telecommunications 
Advisory Committee's (NSTAC) Telecommunications 
and Electric Power Interdependency Task Force 
(TEPITF) examined national security and emergency 
preparedness (NS/EP) concerns associated with 
interdependencies between the telecommunications 
and electric power sectors. Based on the TEPITF’s 
examinations of current operational issues between 
the sectors and how the interdependencies will affect 
both Infrastructures, the NSTAC recommends that 
the President, in accordance with responsibilities 
and existing mechanisms established by Executive 
Order 12472, Assignment of National Security and Emergency 
Preparedness Telecommunications Functions, and other 
existing authority, direct the appropriate departments 
and agencies to— 

► Define and establish the term “Emergency 
Responder” within the National Response Plan 
(NRP) and other appropriate plans, guidance, 
directives, and statutes. 

► Ensure that key response personnel of critical 
infrastructure owners and operators in the 
telecommunications and electric power sectors 
be designated as Emergency Responders, and 
included In local, regional. State, and Federal 
Government emergency plans. 

► Include fuel supply to critical telecommunications 
and electric power infrastructures as part of 

the Emergency Responder planning process 
to ensure that fuel deliveries receive adequate 
priority, access, and security during a disaster. 

► Foster and promote effective emergency 
coordination structures to ensure reliable and 
robust communication between the two sectors and 
local, regional. State, and Federal Governments. 


• Review examples of proven priority restoration 
models at the State and regional levels. 
Encourage States and metropolitan regions 
without effective models to improve and 
update their existing frameworks. 

• Encourage effective information sharing 
models at the local/regional Emergency 
Responder levels, both in advance of a natural 
disaster and during the emergency restoration 
period. When developing these models, 
liability issues should be considered. 

The NSTAC’s Legislative and Regulatory Task Force 
(LRTF) evaluated the lessons learned from Hurricane 
Katrina and developed recommendations designed 
to strengthen the ability of telecommunications 
providers to respond even more effectively to future 
hurricanes and other natural or manmade events. 
Based on the LRTF’s examination, the NSTAC 
recommends that, no later than June 1, 2006, 

In accordance with responsibilities and existing 
mechanisms established by Executive Order 12472, 
Assignment of National Security and Emergency Preparedness 
Telecommunications Functions, and other existing 
authorities, that the President establish and codify 
the term “Emergency Responder (Private Sector)” to 
include telecommunications infrastructure providers 
and ensure non-monetary assistance, including 
accessing restricted areas and obtaining fuel, water, 
power, billeting, and workforce and asset security, 
to them by— 

► Directing the Department of Homeland Security 
(DHS) to modify the NRP and its Emergency 
Support Functions (ESF) to designate 
telecommunications infrastructure providers 
as Emergency Responders (Private Sector) 
and to establish protocols and procedures 
for the way in which Federal, State, local. 
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and tribal Governments should work with 
telecommunications infrastructure providers 
before, during, and after a national disaster. 

► Issuing appropriate Presidential guidance 
to define Emergency Responders (Private 
Sector) under the Robert T. Stafford Disaster Relief 
and Emergency Assistance (Stafford) Act and other 
authorities as appropriate to align with the 
broadened definition of national defense in the 
2003 amendments to the Defense Production Act 
(DPA)ofl950. Specifically, the guidance should 
make clear that key response personnel of critical 
telecommunications infrastructure owners and 
operators should be defined as Emergency 
Responders (Private Sector) and should receive 
non-monetary Federal assistance under the 
Stafford Act 

► Directing the Secretary of Homeland Security to 
work with Congress to align the Stafford Act and 
other appropriate legislative authorities with the 
DPA by codifying the designation of private sector 
telecommunications infrastructure providers as 
Emergency Responders (Private Sector) and by 
codifying the official interpretation that for-profit 
telecommunications infrastructure providers 
should receive non-monetary Federal assistance. 

The Next Generation Networks (NGN) Task Force 
(NGNTF) of the NSTAC examined the provisioning 
of NS/EP communications services on converged 
networks. Based on its examination, the NSTAC 
recommends, in accordance with responsibilities 
and existing mechanisms established by Executive 
Order 12472, Assignment of National Security and 
Emergency Preparedness Telecommunications Eunctions, that 
the President— 

► Identity Management. Direct the Office of 
Management and Budget (0MB), the Department 
of Commerce (DOC), and DHS to work with the 
private sector in partnership to build a federated, 
interoperable, survivable, and effective identity 
management framework for the NGN that: 

(1) includes a common assurance taxonomy that 
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addresses NS/EP requirements and is usable In 
both the Government and commercial domains; 

(2) minimizes identity “silos,” allows federation 
between the Government and commercial domains, 
and supports use of Government-issued credentials 
for identification on the NGN; (3) meets other NS/EP 
requirements, including for priority access to NS/EP 
communications services; (4) supports broad use 
of commercial technology, along with existing and 
emerging protocols and standards; and (5) includes 
explicit protections for privacy. 

► Coordination on Common Operationai Criteria for 
NGN NS/EP End-to-End Services. Direct the Office 
of Science and Technology (OSTP), with support 
from the collective National Communication 
System (NCS) agencies, to establish a Common 
Operational Criteria development framework to 
meet NS/EP user requirements on the NGN. This 
would be a joint Industry-Government initiative to 
ensure NS/EP communications capabilities in the 
NGN environment, and would include the creation 
of a regular NGN summit with annual reporting that 
would enable telecommunIcatlon/IT Industry sector 
and Government stakeholders to: (1) develop and 
coordinate common NGN planning activities; 

(2) measure progress of NGN-related efforts; and 

(3) recommend and monitor programs that would 
foster NS/EP capabilities within the NGN, including 
initiatives concerning: 

• A priority regime for both encrypted and 
unencrypted packets supported by a set of 
standards specifying how that priority is to 
be translated end-to-end among the different 
networks connected to the NGN, consistent 
with a user's NS/EP authorization and required 
class of service; and 

• NGN designs that respond to NS/EP 
requirements, including supporting a mixed 
protocol operational environment during the 
transition into Internet Protocol version 6; 
peer-to-peer networks and systems for 
independence from centralized infrastructure; 
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meshed networks for resiliency and 
deployability; and Internet Protocol security for 
authentication and confidentiality. 

► Research and Development (R&D). In support of the 
prior recommendation, direct OSTP, with support 
from ofher relevant agencies, especially the Science 
and Technology Directorate of DHS, the National 
Institute of Standards and Technology (NIST), and 
the Department of Defense (DOD) to establish and 
prioritize within the Federal Government Initiatives 
that will foster collaborative and coordinated R&D 
supporting the Common Operational Criteria and 
accelerate demonstrations of critical NGN 
NS/EP-supporting capabilities or technology among 
NGN telecommunication/ IT and service providers. 

► Technology Lifecycle Assurance and Trusted Technology. 

Direct 0MB, OSTP, DOD, DEIS, and DOC to drive 
comprehensive change in the security of NS/EP 
informafion and communicafions technology 
through policy, incentives, and research supporting 
the development and use of: (1) technology 
lifecycle assurance mechanisms and (2) innovative 
trusted technologies that reduce the presence of 
intrinsic vulnerabilities. 

► Resilient Alternate Communications. Direct 0MB 
and DHS, in accordance with their respective 
authorities, to ensure that Eederal agencies 
are developing, investing in, and maintaining 
resilient, alternate communications for the NGN 
environment. Specifically, DHS and 0MB should 
require that NS/EP communicators, including 
incident managers and emergency responders, 
plan for communications resiliency especially 
by examining alternative or substitute access 
methods to the NGN to address specific threat 
scenarios, which methods can augment and 
possibly replace, at least temporarily, damaged, 
or diminished access to the communications 
infrastructure. 
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► Agreements, Standards, Policy, and Regulations. 

Direct DHS, the Department of Sfate, and 
the DOC (including NIST and the National 
Telecommunications and Information 
Administration [NTIA]) to engage actively with 
and coordinate among appropriate domestic and 
international entitles to ensure that the relevant 
policy frameworks support NGN NS/EP capabilities. 
These policy frameworks are established through 
Agreements, Standards, Policies, and Regulations 
(ASPR). As part of the Common Operational Criteria 
development framework, these agencies should 
continuously monitor the entire lifecycle of ASPR 
associated with ensuring NS/EP capabilities to 
identify and acf on opportunifies to enhance ASPR, 
address their vulnerabilities, and eliminate potential 
Impediments to providing NS/EP capabilities in a 
globally distributed NGN environment. 

► Incident Management on the NGN. Direct DHS 
to establish an inclusive and effective NGN 
incident response capability that includes a Joint 
Coordination Center, incorporating and modeled on 
the National Coordinating Center (NCC), for all key 
sectors, but particularly both the Communications 
and IT Sectors, and supporting mechanisms 
such as a training academy and a collaboratively 
developed, broadly participatory, and regularly 
evaluated exercise program. This capability should 
be enhanced by an appropriate R&D program. 

► International Policy. Direct departments and 
agencies to develop cohesive domestic 
and International NS/EP communications 
policy consistent with the recommendations 
in this report, in particular: (1) developing 
intergovernmental cooperation mechanisms to 
harmonize NS/EP policy regimes in participating 
countries consistent with the recommendations 
in this report; (2) establishing the rules of 
engagemenf for non-United Sfates companies in 
NS/EP incident response in the United States; 
and (3) addressing how information sharing and 
response mechanisms should operate in the 
International NGN environment. 
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► First Responders. Direct DHS and other appropriate 
Government agencies to assist first responders 
and public safety organizations in making the 
transition to the NGN, which will provide them 
with greater capabilities, but will also be a 
challenge to achieve given their limited resources 
and legacy systems. 

The NSTAC’s Emergency Communications and 
Interoperability Task Force (ECITF) examined and 
identified immediate action that could be taken of 
behalf of the Federal Government to significantly 
improve the Nation’s emergency communications 
capabilities prior to the upcoming 2006 hurricane 
season while recognizing that some elements may 
have already begun. Based on the ECITF analysis, 
the NSTAC recommends, in accordance with 
responsibilities and existing mechanisms established 
by Executive Order 12472, Assignment of National 
Security and Emergency Preparedness Telecommunications 
Functions, and other existing authority, that the 
President direct the DHS and other appropriate 
agencies to accelerate their efforts and adequately 
resource actions to assure completion, prior to the 
summer of 2006, of the recommended initiatives 
listed below— 

► Establish a uniform protocol working with 
Federal, State, and local Government 
organizations that can dynamically identify their 
emergency management coordinators’ contact 
information, especially during times when regular 
contact information is changed due to event 
situations, and have capability to share that 
information with DHS {e.g., via websites). This 
capability should be administered by the NCS in 
concert with the NCC to assist in its execution of 
ESF#2 for communications. 

► Create a deployable communications capability 
for the Gulf Coast region in accordance with 
Recommendation #37 of the White House report. 
The Federal Response to Hurricane Katrina: Lessons 
Learned. This capability must focus on rapidly 
deployable, inferoperable mobile communications 
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solutions that will provide reliable communications 
to emergency responders at all levels of 
Government In a disaster-affected region. 

► Formally Integrate the NCS NS/EP priority 
programs {e.g., Telecommunications 
Service Priority, Government Emergency 
Telecommunications Service, and Wireless Priority 
Service) into the National Emergency Communications 
Strategy pursuant to Recommendation #34 of the 
Lessons Learned Report. 

► Direct NTIA to work in conjunction with the 
Federal Communications Commission to 
streamline the authorization process for use of 
Federal incident response frequencies by the 
larger non-Federal Government emergency 
response community. 

In addition to these immediately applicable 
recommendations, the NSTAC recommends that 
the President consider incorporating into the 
overa 11 National Emergency Communications Strategy the 
NSTAC’s previous recommendations regarding 
ensuring access and suitable credentialing for 
telecommunications infrastructure provider response 
personnel, formally designating such personnel as 
Emergency Responders (Private Sector) to enable 
provision of non-monetary Federal assisfance under 
the Stafford Act, and improving Industry-Government 
incident response coordination via the NCC. 

The NSTAC’s NCC Task Force (NCCTF) undertook 
a comprehensive review of the NCC and specifically 
examined the direction of the NCC over the next year, 
three years, and five years, and considered some of the 
major challenges that the NCC has faced in disaster 
response efforts, such as Hurricane Katrina response 
and recovery. Based on the findings of fhe NCCTF, fhe 
NSTAC recommends that the President, in accordance 
with responsibilities and existing mechanisms 
established by Executive Order 12472, Assignment of 
National Security and Emergency Preparedness Telecommunications 
Functions, and other existing authority— 
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► Work to improve and comply with the ESF#2 
Federal Operations Plan by— 

• Acknowledging the Federal Emergency 
Communications Coordinator as the lead of 
ESF#2 in the region. 

• Accommodating communications industry 
personnel within the Joint Field Offices 
(JFO), or as a virtual capability, to provide for 
regional company-to-company and industry 
to Government information sharing and 
coordination. 

► Direct the Secretary of Homeland Security, the 
Director of OSTP, fhe Secretary of Defense, and 
ofher ESF#2 Federal support agencies to develop 
and implement policies and procedures with 
respect to: (1) managing and escalating requests 
from fhe NCC, and (2) the delineation of authorities 
and responsibilities when ESF#2 is invoked. 

► Direct OSTP and the Homeland Security Council to 
join with the Communications Sector Coordinating 
Council (SCO and the IT-SCC to support an 
industry-led task force with the primary goal 

of planning a regional communications and IT 
coordinating capability in the Gulf Coast and 
Southeastern regions prior to the 2006 hurricane 
season. Subsequently, the task force will determine 
the best approach for a long-term regional 
communications and IT coordinating capability 
that can serve all regions of the Nation. The task 
force should primarily be made up of industry 
representatives, as well as Federal, State, and local 
Government representatives. 
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► Direct the Secretary of Homeland Security to 
expand the NCC to include both communications 
and IT companies and organizations. This would 
be a cross-sector industry/Government facility 
with a round-the-clock watch, and would be 
brought up to full strength during emergencies. 

► Direct the Secretary of Homeland Security to 
engage the private sector in critical infrastructure 
protection activities by increasing the flow of 
fhreat information to the private sector, facilitating 
private sector participation in impact analyses, 
and clarifying policies for the protection of private 
sector Information. 

► Direct the Secretary of Homeland Security 
to improve the ESF#2 Emergency Response 
Training and Exercise program, with a focus on 
enhancing coordination among industry members 
and Federal, State, and local responders during 
incidents of national significance. This program 
should focus on sector Interdependencies for 
bofh physical and cyber fhreats, and would aim 
to produce actionable results. Industry must be 
involved from the earliest planning stages. 

► Encourage the Secretary of Homeland Security to 
improve the Federal Government’s cyber response 
strategy to delineate roles and responsibilities of 
Government and the private sector in the NRP, 
aligning communications and cyber operations 
centers, and enhancing relationships with 
international computer emergency readiness teams. 

► Direct the Secretary of Homeland Security and 
other Government stakeholders to examine the 
value received from the NCC relationship and, 
if sufficiently supported, commit the resources 
necessary to strengthen and support the 
organization and its mission. 
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Attachment 2: Attendance of Members at the 29th Meeting of the 
President’s National Security Telecommunications Advisory Committee 
(NSTAC XXIX)-May 10,2006 


Mr. F. Duane Ackerman 

Mr. Arthur Johnson* 

Mr. Stratton Sclavos 

Chair 

BellSouth Corporation 

Lockheed Martin Corporation 

VeriSign, Inc. 


Mr. Clayton M. Jones 

Mr. Stanley Sigman 

Mr. Gregory Q. Brown 

Motorola, Inc. 

Rockwell Collins, Inc. 

CTIA—The Wireless Association 


Mr. Scott Kriens 

Mr. Randall L. Stephenson 

Mr. Lawrence T. Babbio, Jr. 

Verizon Communications, Inc. 

Juniper Networks, Inc. 

AT&T, Inc. 


Mr. Walter McCormick* 

Mr. William H. Swanson 

Mr. Kenneth Dabiberg 

Science Applications International 

United States Telecom Association 

Raytheon Company 

Corporation 

Mr. Craig T. Mundie 

Mr. Lawrence A. Weinbach 

Mr. Gary D. Forsee 

Microsoft Corporation 

Unisys Corporation 

Sprint Nextel Corporation 

Mr. Donald J. Dbert 

Mr. Joseph R. Wright, Jr. 

Mr. Van B. Honeycutt 

Computer Sciences Corporation 

Bank of America Corporation 

PanAmSat Corporation 


* Pending Principals 
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Acronym List 


AIN .Advanced Intelligent Networks 

AlP .Automated Information Processing 

ASPR .Agreements, Standards, Policies, 

and Regulations 

ATIS .Alliance for Telecommunications 

Industry Solutions 

CCS .Common Channel Signaling 

CIAO .Critical Infrastructure Assurance Office 

CM .Critical Infrastructure Information 

CIP .Critical Infrastructure Protection 

CNS .Commercial Network Survivability 

COP .Committee of Principals 

COR .Council of Representatives 

CSI .Commercial SATCOM Interconnectivity 

CSS .Commercial Satellite Survivability 

CTF .Convergence Task Force 

CWIN .Cyber Warning Information Network 

OARPA .Defense Advanced Research Projects Agency 

DDoS .Distributed Denial of Service 

OHS .Department of Flomeland Security 

DOC .Department of Commerce 

000 .Department of Defense 

DOE .Department of Energy 

DOJ .Department of Justice 

DOS .Department of State 

DPA .Defense Production Act 

E.O .Executive Order 

EC .Electronic Commerce 

ECC .Enhanced Call Completion 

ECITF .Emergency Communications and 

Interoperability Task Force 

ELS .Essential Line Service 

EMP .Electromagnetic Pulse 

EPA .Environmental Protection Agency 

ERPWG .Emergency Response Procedures Working Group 

ESP .National Electric Service Priority 


ETSITIPHON .. European Telecommunications Standards 


Institute Telecommunications and Internet 
Protocol Flarmonization over Networks 

FCC .Federal Communications Commission 

FNI .Funding of NSTAC Initiatives 

FOIA .The Freedom of Information Act 

FRB .Federal Reserve Board 

FRP .Federal Response Plan 


FRWG .Funding and Regulatory Working Group 

FS .Financial Services 

FSTF .Financial Services Task Force 

GETS .Government Emergency 

Telecommunications Service 

GM .Global Information Infrastructure 

GSA .General Services Administration 

GTF .Globalization Task Force 

GTISC .Georgia Tech Information Security Center 

HPC .Fligh Probability of Call Completion 

HSPD .Flomeland Security Presidential Directive 

l&C .Information & Communications 

lA .Information Assurance 

lAlP .Information Analysis and Infrastructure 

Protection 

lATF .Information Assurance Task Force 

lAW .Indications Assessment and Warnings 

ID .Identification 

IDSG .Intrusion Detection Subgroup 

IDT .International Diplomatic Telecommunications 

lEPS .International Emergency Preference Scheme 

lES .Industry Executive Subcommittee 

MG .Information Infrastructure Group 

MS .Industry Information Security 

IN .Intelligent Networks 

IP .Internet Protocol 

IS/CIP .Information Sharing/Critical Infrastructure 

Protection 

ISAC .Information Sharing and Analysis Center 

ISATF .Internet Security/Architecture Task Force 

ISEC .Information Security Exploratory Committee 

ISP .Internet Service Provider 

ISSB .Information Systems Security Board 

IT .Information Technology 

ITIC .Information Technology Industry Council 

ITPITF .Information Technology Progress Impact 

Task Force 

LMBATF .Last Mile Bandwidth Availability Task Force 

LRG .Legislative and Regulatory Group 

LRTF .Legislative and Regulatory Task Force 

LRWG .Legislative and Regulatory Working Group 

LTO .Long-term Outage 

MTT .Mobile Transportable Telecommunications 

NAP .Network Access Provider 
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NCC .National Coordinating Center 

NCM .National Coordinating Mechanism 

NCO .National Coordination Office 

NCS .National Communications System 

NCSP .National Cyber Security Partnership 

NERC .North American Electric Reliability Council 

NES .National Energy Strategy 

NG .Network Group 

NGN .Next Generation Network 

NGNTF .Next Generation Networks Task Force 

Nil .National Information Infrastructure 

NIPC .National Infrastructure Protection Center 

NIST .National Institute of Standards and Technology 

NLP .National Level Program 

NPTF .National Plan to Defend Critical Infrastructures 

Task Force 

NRG .National Research Council 

NRIC .Network Reliability and Interoperability Council 

NRP .National Response Plan 

NS/EP .National Security and Emergency Preparedness 

NS/VATF .Network Security/Vulnerability Assessments 

Task Force 

NSA .National Security Agency 

NSDD .National Security Decision Directive 

NSG .National Security Group 

NSIE .Network Security Information Exchange 

NSSE .National Special Security Events 

NSTAC .National Security Telecommunications Advisory 

Committee 

NSTF .Network Security Task Force 

NTIA .National Telecommunications and 

Information Administration 

NTMS .National Telecommunications 

Management Structure 

NWC .Naval War College 

OAM&P .Operations, Administration, Maintenance, 

and Provisioning 

0MB .Office of Management and Budget 

OMNCS .Office of the Manager, 

National Communications System 

OS .Operating System 

OSTP .Office of Science and Technology Policy 

OWG .Operations Working Group 

PAS .Priority Access Service 

PCCIP .President’s Commission on Critical 

Infrastructure Protection 


PCM .Protected Critical Infrastructure Information 

POD .Presidential Decision Directive 

PN .Public Network 

PO .Program Office 

PSN .public switched network 

PSTN .Public Switched Telephone Network 

PWG .Plans Working Group 

QoS .Quality of Service 

R&D .Research and Development 

R&O .Report and Order 

RDTF .Research and Development Task Force 

RDX .Research and Development Exchange 

RDXTF .Research and Development Exchange 

Task Force 

REWG .Resource Enhancements Working Group 

RP .Restoration Priority 

SAFETY Act ... Support Anti-terrorism by Fostering 
Effective Technologies Act 

SATCOM .Satellite Communications 

see.Sector Coordinating Council 

SCOE .Security Center of Excellence 

SME .Subject Matter Experts 

SOP .Standard Operating Procedure 

SRWG .Security Requirements Working Group 

SS7 .Signaling System 7 

Stafford Act. .. Robert T. Stafford Disaster Relief 
and Emergency Assistance Act 

STF .Satellite Task Force 

STU .Secure Telephone Unit 

TATF .Trusted Access Task Force 

Telecom Act. .. Telecommunications Act of 1996 

TEPITF .Telecommunications and Electric Power 

Interdependency Task Force 

TESP .Telecommunications Electric Service Priority 

TIM .Telecommunications Industry Mobilization 

TIP .Telecommunications Infrastructure Providers 

TSA .Transportation Security Administration 

TSP .Telecommunications Service Priority 

TSS .Telecommunications Systems Survivability 

USSS .United States Secret Service 

UST .Underground Storage Tanks 

VTF .Vulnerabilities Task Force 

W/LBRDSTF ... Wireless/Low-Bit-Rate Digital Services 
Task Force 

WPS .Wireless Priority Service 

WSPO .Wireless Services Program Office 
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WSTF .Wireless Services Task Force 

WTF .Wireless Task Force 

Y2K .Year 2000 

Y2KAct .Year 2000 Readiness and Disclosure Act 
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